in Formula/auditbeat-oss.rb [9:25]
def install
["fields.yml", "ingest", "kibana", "module"].each { |d| libexec.install d if File.exist?(d) }
(libexec/"bin").install "auditbeat"
(etc/"auditbeat").install "auditbeat.yml"
(etc/"auditbeat").install "modules.d" if File.exist?("modules.d")
(bin/"auditbeat").write <<~EOS
exec
--path.config
--path.data
--path.home
--path.logs
"$@"
EOS
end