{
  "repo": "elastic/beats",
  "binary": "auditbeat",
  "binary_path": "auditbeat/main.go",
  "surface_kind": "worker_service",
  "type": "worker_service",
  "extensions": {
    "notes": [
      "auditbeat/main.go executes cmd.RootCmd and runs as a long-lived beat process.",
      "The binary is not a one-shot admin CLI."
    ]
  },
  "services": [
    {
      "name": "Auditbeat",
      "package": "github.com/elastic/beats/v7/auditbeat/cmd",
      "methods": [
        {
          "name": "auditbeat",
          "name_key": "Auditbeat.Run",
          "input": "cobra flags + audit sources + outputs",
          "output": "continuous collection and shipping of audit events",
          "type": "worker"
        }
      ]
    }
  ]
}