[Unit]
Description=Audit the activities of users and processes on your system to Elasticsearch OSS or OpenSearch.
Documentation=https://www.elastic.co/guide/en/beats/auditbeat/7.12/index.html
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"
Environment="BEAT_CONFIG_OPTS=-c /etc/auditbeat-oss/auditbeat.yml"
Environment="BEAT_PATH_OPTS=-path.home /usr/share/auditbeat-oss -path.config /etc/auditbeat-oss -path.data /var/lib/auditbeat-oss -path.logs /var/log/auditbeat-oss"
ExecStart=/usr/bin/auditbeat-oss $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target