apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterInput
metadata:
  name: k8s-node-auditd
  labels:
    fluentbit.fluent.io/enabled: "true"
spec:
  alias: auditd-tail
  tail:
    db: /var/log/flb_auditd.db
    memBufLimit: 100MB
    path: /var/log/audit/audit.log
    refreshIntervalSeconds: 10
    tag: k8s_node.auditd.$${NODE_NAME}