--- auditbeat/auditbeat.reference.yml.orig	2026-01-07 19:28:13 UTC
+++ auditbeat/auditbeat.reference.yml
@@ -14,7 +14,7 @@ auditbeat.config.modules:
 auditbeat.config.modules:
 
   # Glob pattern for configuration reloading
-  path: ${path.config}/modules.d/*.yml
+  path: ${path.config}/auditbeat.modules.d/*.yml
 
   # Period on which files under path should be checked for changes
   reload.period: 10s
@@ -1250,7 +1250,7 @@ output.elasticsearch:
 
 # The directory from where to read the dashboards. The default is the `kibana`
 # folder in the home path.
-#setup.dashboards.directory: ${path.home}/kibana
+#setup.dashboards.directory: %%DATADIR%%/auditbeat/kibana
 
 # The URL from where to download the dashboard archive. It is used instead of
 # the directory if it has a value.