<source>
  @type tail
  @id audit-input
  @label @INGRESS
  path "#{ENV['AUDIT_FILE'] || '/var/log/audit/audit.log'}"
  pos_file "#{ENV['AUDIT_POS_FILE'] || '/var/log/audit/audit.log.pos'}"
  tag audit.log
  format viaq_docker_audit
</source>
