audispd fleet-auditd ^node=(\S+) type=(\w+) msg=audit\(([\d.]+):(\d+)\): audit.node,audit.type,audit.timestamp,audit.serial fleet-auditd auid=(\d+) audit.auid fleet-auditd (?:res|success)=(\S+) audit.res fleet-auditd exe="([^"]+)" audit.exe