diff --git a/Vagrantfile b/Vagrantfile
index 47857ef61c05..86da498e6c0f 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -55,6 +55,15 @@ cd ~/go/src/github.com/elastic
 if [ -d "/vagrant" ]; then ln -s /vagrant beats; fi
 SCRIPT
 
+# Linux GVM
+$linuxGvmProvision = <<SCRIPT
+mkdir -p ~/bin
+curl -sL -o ~/bin/gvm https://github.com/andrewkroh/gvm/releases/download/v0.0.1/gvm-linux-amd64
+chmod +x ~/bin/gvm
+echo 'export PATH=~/bin:$PATH' >> ~/.bash_profile
+echo 'eval "$(gvm 1.8.3)"' >> ~/.bash_profile
+SCRIPT
+
 Vagrant.configure(2) do |config|
 
   # Windows Server 2012 R2
@@ -110,6 +119,18 @@ Vagrant.configure(2) do |config|
     openbsd.vm.provision "shell", inline: $unixProvision, privileged: false
   end
 
+  # CentOS 7
+  config.vm.define "centos7", primary: true do |centos7|
+    #centos7.vm.box = "http://cloud.centos.org/centos/7/vagrant/x86_64/images/CentOS-7-x86_64-Vagrant-1706_02.VirtualBox.box"
+    centos7.vm.box = "ubuntu/precise64"
+    centos7.vm.network :forwarded_port, guest: 22,   host: 2226,  id: "ssh", auto_correct: true
+
+    centos7.vm.provision "shell", inline: $unixProvision, privileged: false
+    centos7.vm.provision "shell", inline: $linuxGvmProvision, privileged: false
+
+    centos7.vm.synced_folder ".", "/vagrant", type: "virtualbox"
+  end
+
 end
 
 # -*- mode: ruby -*-
diff --git a/auditbeat/docs/fields.asciidoc b/auditbeat/docs/fields.asciidoc
index e3e042402709..744351c10e38 100644
--- a/auditbeat/docs/fields.asciidoc
+++ b/auditbeat/docs/fields.asciidoc
@@ -47,6 +47,13 @@ type: keyword
 
 The path to the file.
 
+[float]
+=== audit.file.target_path
+
+type: keyword
+
+The target path for symlinks.
+
 [float]
 === audit.file.action
 
@@ -54,9 +61,16 @@ type: keyword
 
 example: attributes_modified
 
-Action describes the change to the file. The possible values are: attributes_modified, created, deleted, updated, moved_to, collision_within, unmounted, root_changed.
+Action describes the change to the file. The possible values are: attributes_modified, created, deleted, updated, and moved.
 
 
+[float]
+=== audit.file.type
+
+type: keyword
+
+The file type (file, dir, or symlink).
+
 [float]
 === audit.file.inode
 
@@ -92,6 +106,13 @@ type: keyword
 
 The primary group name of the file.
 
+[float]
+=== audit.file.sid
+
+type: keyword
+
+The security identifier (SID) of the file owner (Windows only).
+
 [float]
 === audit.file.mode
 
@@ -137,6 +158,27 @@ type: boolean
 Boolean indicating if the event includes a file hashes. If true the md5, sha1, and sha256 fields will be present.
 
 
+[float]
+=== audit.file.md5
+
+type: keyword
+
+MD5 hash of the file.
+
+[float]
+=== audit.file.sha1
+
+type: keyword
+
+SHA1 hash of the file.
+
+[float]
+=== audit.file.sha256
+
+type: keyword
+
+SHA256 hash of the file.
+
 [float]
 == kernel Fields
 
diff --git a/auditbeat/docs/images/auditbeat-file-integrity-dashboard.png b/auditbeat/docs/images/auditbeat-file-integrity-dashboard.png
new file mode 100644
index 000000000000..1d24cbb6a744
Binary files /dev/null and b/auditbeat/docs/images/auditbeat-file-integrity-dashboard.png differ
diff --git a/auditbeat/module/audit/_meta/kibana/default/dashboard/Auditbeat-audit.json b/auditbeat/module/audit/_meta/kibana/default/dashboard/Auditbeat-audit.json
deleted file mode 100644
index f1a4b09b30dc..000000000000
--- a/auditbeat/module/audit/_meta/kibana/default/dashboard/Auditbeat-audit.json
+++ /dev/null
@@ -1,132 +0,0 @@
-{
-  "objects": [
-    {
-      "attributes": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\n  \"filter\": []\n}"
-        },
-        "savedSearchId": "02014c80-29d2-11e7-a68f-bfaa2341cc52",
-        "title": "HTTP ping times",
-        "uiStateJSON": "{}",
-        "version": 1,
-        "visState": "{\n  \"title\": \"HTTP ping times\",\n  \"type\": \"area\",\n  \"params\": {\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\",\n    \"scale\": \"linear\",\n    \"interpolate\": \"linear\",\n    \"mode\": \"stacked\",\n    \"times\": [],\n    \"addTimeMarker\": false,\n    \"defaultYExtents\": false,\n    \"setYExtents\": false\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"resolve.rtt.us\",\n        \"customLabel\": \"\"\n      }\n    },\n    {\n      \"id\": \"3\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"tcp.rtt.connect.us\"\n      }\n    },\n    {\n      \"id\": \"5\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"tls.rtt.handshake.us\"\n      }\n    },\n    {\n      \"id\": \"4\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"http.rtt.response_header.us\"\n      }\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"date_histogram\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"@timestamp\",\n        \"interval\": \"auto\",\n        \"customInterval\": \"2h\",\n        \"min_doc_count\": 1,\n        \"extended_bounds\": {}\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
-      },
-      "id": "c65ef340-eb19-11e6-be20-559646f8b9ba",
-      "type": "visualization",
-      "version": 1
-    },
-    {
-      "attributes": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\n  \"filter\": []\n}"
-        },
-        "savedSearchId": "02014c80-29d2-11e7-a68f-bfaa2341cc52",
-        "title": "HTTP monitors status",
-        "uiStateJSON": "{\n  \"vis\": {\n    \"colors\": {\n      \"200\": \"#B7DBAB\",\n      \"monitor.status: up\": \"#629E51\",\n      \"monitor.status: down\": \"#E24D42\"\n    },\n    \"legendOpen\": true\n  }\n}",
-        "version": 1,
-        "visState": "{\n  \"title\": \"HTTP monitors status\",\n  \"type\": \"pie\",\n  \"params\": {\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"bottom\",\n    \"isDonut\": false\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"cardinality\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"monitor.id\"\n      }\n    },\n    {\n      \"id\": \"3\",\n      \"enabled\": true,\n      \"type\": \"filters\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"filters\": [\n          {\n            \"input\": {\n              \"query\": {\n                \"query_string\": {\n                  \"query\": \"monitor.status: up\",\n                  \"analyze_wildcard\": true\n                }\n              }\n            },\n            \"label\": \"\"\n          },\n          {\n            \"input\": {\n              \"query\": {\n                \"query_string\": {\n                  \"query\": \"monitor.status: down\",\n                  \"analyze_wildcard\": true\n                }\n              }\n            }\n          }\n        ]\n      }\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"http.response.status\",\n        \"size\": 5,\n        \"order\": \"desc\",\n        \"orderBy\": \"1\"\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
-      },
-      "id": "920e8140-eb1a-11e6-be20-559646f8b9ba",
-      "type": "visualization",
-      "version": 1
-    },
-    {
-      "attributes": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\n  \"filter\": []\n}"
-        },
-        "savedSearchId": "02014c80-29d2-11e7-a68f-bfaa2341cc52",
-        "title": "HTTP monitors",
-        "uiStateJSON": "{\n  \"vis\": {\n    \"params\": {\n      \"sort\": {\n        \"columnIndex\": null,\n        \"direction\": null\n      }\n    }\n  }\n}",
-        "version": 1,
-        "visState": "{\n  \"title\": \"HTTP monitors\",\n  \"type\": \"table\",\n  \"params\": {\n    \"perPage\": 10,\n    \"showPartialRows\": false,\n    \"showMeticsAtAllLevels\": false,\n    \"sort\": {\n      \"columnIndex\": null,\n      \"direction\": null\n    },\n    \"showTotal\": false,\n    \"totalFunc\": \"sum\"\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"monitor.duration.us\"\n      }\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"bucket\",\n      \"params\": {\n        \"field\": \"monitor.id\",\n        \"size\": 5,\n        \"order\": \"desc\",\n        \"orderBy\": \"1\"\n      }\n    },\n    {\n      \"id\": \"5\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"resolve.rtt.us\"\n      }\n    },\n    {\n      \"id\": \"6\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"tcp.rtt.connect.us\"\n      }\n    },\n    {\n      \"id\": \"7\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"tls.rtt.handshake.us\"\n      }\n    },\n    {\n      \"id\": \"8\",\n      \"enabled\": true,\n      \"type\": \"max\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"http.rtt.response_header.us\"\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
-      },
-      "id": "1738dbc0-eb1d-11e6-be20-559646f8b9ba",
-      "type": "visualization",
-      "version": 1
-    },
-    {
-      "attributes": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\n  \"filter\": []\n}"
-        },
-        "savedSearchId": "02014c80-29d2-11e7-a68f-bfaa2341cc52",
-        "title": "HTTP up status",
-        "uiStateJSON": "{\n  \"vis\": {\n    \"colors\": {\n      \"monitor.status: up\": \"#629E51\",\n      \"monitor.status: down\": \"#E24D42\"\n    }\n  }\n}",
-        "version": 1,
-        "visState": "{\n  \"title\": \"HTTP up status\",\n  \"type\": \"area\",\n  \"params\": {\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\",\n    \"scale\": \"linear\",\n    \"interpolate\": \"linear\",\n    \"mode\": \"percentage\",\n    \"times\": [],\n    \"addTimeMarker\": false,\n    \"defaultYExtents\": false,\n    \"setYExtents\": true,\n    \"yAxis\": {\n      \"max\": 100,\n      \"min\": 0\n    }\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"date_histogram\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"@timestamp\",\n        \"interval\": \"auto\",\n        \"customInterval\": \"2h\",\n        \"min_doc_count\": 1,\n        \"extended_bounds\": {}\n      }\n    },\n    {\n      \"id\": \"3\",\n      \"enabled\": true,\n      \"type\": \"filters\",\n      \"schema\": \"group\",\n      \"params\": {\n        \"filters\": [\n          {\n            \"input\": {\n              \"query\": {\n                \"query_string\": {\n                  \"query\": \"monitor.status: down\",\n                  \"analyze_wildcard\": true\n                }\n              }\n            },\n            \"label\": \"\"\n          },\n          {\n            \"input\": {\n              \"query\": {\n                \"query_string\": {\n                  \"query\": \"monitor.status: up\",\n                  \"analyze_wildcard\": true\n                }\n              }\n            }\n          }\n        ]\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
-      },
-      "id": "091c3a90-eb1e-11e6-be20-559646f8b9ba",
-      "type": "visualization",
-      "version": 1
-    },
-    {
-      "attributes": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\n  \"filter\": []\n}"
-        },
-        "savedSearchId": "02014c80-29d2-11e7-a68f-bfaa2341cc52",
-        "title": "HTTP duration heatmap",
-        "uiStateJSON": "{\n  \"vis\": {\n    \"defaultColors\": {\n      \"0 - 2\": \"rgb(247,251,255)\",\n      \"2 - 3\": \"rgb(227,238,249)\",\n      \"3 - 4\": \"rgb(208,225,242)\",\n      \"4 - 5\": \"rgb(182,212,233)\",\n      \"5 - 6\": \"rgb(148,196,223)\",\n      \"6 - 8\": \"rgb(107,174,214)\",\n      \"8 - 9\": \"rgb(74,152,201)\",\n      \"9 - 10\": \"rgb(46,126,188)\",\n      \"10 - 11\": \"rgb(23,100,171)\",\n      \"11 - 12\": \"rgb(8,74,145)\"\n    }\n  }\n}",
-        "version": 1,
-        "visState": "{\n  \"title\": \"HTTP duration heatmap\",\n  \"type\": \"heatmap\",\n  \"params\": {\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"enableHover\": false,\n    \"legendPosition\": \"right\",\n    \"times\": [],\n    \"colorsNumber\": 10,\n    \"colorSchema\": \"Blues\",\n    \"setColorRange\": false,\n    \"colorsRange\": [],\n    \"invertColors\": false,\n    \"percentageMode\": false,\n    \"valueAxes\": [\n      {\n        \"show\": false,\n        \"id\": \"ValueAxis-1\",\n        \"type\": \"value\",\n        \"scale\": {\n          \"type\": \"linear\",\n          \"defaultYExtents\": false\n        },\n        \"labels\": {\n          \"show\": false,\n          \"rotate\": 0,\n          \"color\": \"#555\"\n        }\n      }\n    ]\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"date_histogram\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"@timestamp\",\n        \"interval\": \"auto\",\n        \"customInterval\": \"2h\",\n        \"min_doc_count\": 1,\n        \"extended_bounds\": {}\n      }\n    },\n    {\n      \"id\": \"3\",\n      \"enabled\": true,\n      \"type\": \"histogram\",\n      \"schema\": \"group\",\n      \"params\": {\n        \"field\": \"monitor.duration.us\",\n        \"interval\": 50000,\n        \"extended_bounds\": {}\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
-      },
-      "id": "0f4c0560-eb20-11e6-9f11-159ff202874a",
-      "type": "visualization",
-      "version": 1
-    },
-    {
-      "attributes": {
-        "columns": [
-          "monitor.id",
-          "http.url",
-          "monitor.status",
-          "http.response.status",
-          "monitor.duration.us",
-          "tcp.rtt.connect.us",
-          "tls.rtt.handshake.us",
-          "resolve.rtt.us",
-          "http.rtt.content.us"
-        ],
-        "description": "",
-        "hits": 0,
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\n  \"index\": \"heartbeat-*\",\n  \"highlightAll\": true,\n  \"query\": {\n    \"query_string\": {\n      \"analyze_wildcard\": true,\n      \"query\": \"*\"\n    }\n  },\n  \"filter\": [\n    {\n      \"$state\": {\n        \"store\": \"appState\"\n      },\n      \"meta\": {\n        \"alias\": null,\n        \"disabled\": false,\n        \"index\": \"heartbeat-*\",\n        \"key\": \"monitor.name\",\n        \"negate\": false,\n        \"value\": \"http\"\n      },\n      \"query\": {\n        \"match\": {\n          \"monitor.name\": {\n            \"query\": \"http\",\n            \"type\": \"phrase\"\n          }\n        }\n      }\n    }\n  ]\n}"
-        },
-        "sort": [
-          "@timestamp",
-          "desc"
-        ],
-        "title": "Heartbeat HTTP pings",
-        "version": 1
-      },
-      "id": "02014c80-29d2-11e7-a68f-bfaa2341cc52",
-      "type": "search",
-      "version": 5
-    },
-    {
-      "attributes": {
-        "description": "",
-        "hits": 0,
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}]}"
-        },
-        "optionsJSON": "{\"darkTheme\":false}",
-        "panelsJSON": "[{\"col\":1,\"id\":\"c65ef340-eb19-11e6-be20-559646f8b9ba\",\"panelIndex\":1,\"row\":7,\"size_x\":12,\"size_y\":4,\"type\":\"visualization\"},{\"col\":9,\"id\":\"920e8140-eb1a-11e6-be20-559646f8b9ba\",\"panelIndex\":2,\"row\":1,\"size_x\":4,\"size_y\":4,\"type\":\"visualization\"},{\"col\":1,\"id\":\"1738dbc0-eb1d-11e6-be20-559646f8b9ba\",\"panelIndex\":3,\"row\":1,\"size_x\":8,\"size_y\":4,\"type\":\"visualization\"},{\"col\":1,\"id\":\"091c3a90-eb1e-11e6-be20-559646f8b9ba\",\"panelIndex\":4,\"row\":5,\"size_x\":12,\"size_y\":2,\"type\":\"visualization\"},{\"col\":1,\"id\":\"0f4c0560-eb20-11e6-9f11-159ff202874a\",\"panelIndex\":5,\"row\":11,\"size_x\":12,\"size_y\":5,\"type\":\"visualization\"}]",
-        "timeRestore": false,
-        "title": "Heartbeat HTTP monitoring",
-        "uiStateJSON": "{\"P-3\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-5\":{\"vis\":{\"defaultColors\":{\"0 - 2\":\"rgb(247,251,255)\",\"2 - 3\":\"rgb(227,238,249)\",\"3 - 4\":\"rgb(208,225,242)\",\"4 - 5\":\"rgb(182,212,233)\",\"5 - 6\":\"rgb(148,196,223)\",\"6 - 8\":\"rgb(107,174,214)\",\"8 - 9\":\"rgb(74,152,201)\",\"9 - 10\":\"rgb(46,126,188)\",\"10 - 11\":\"rgb(23,100,171)\",\"11 - 12\":\"rgb(8,74,145)\"}}}}",
-        "version": 1
-      },
-      "id": "f3e771c0-eb19-11e6-be20-559646f8b9ba",
-      "type": "dashboard",
-      "version": 1
-    }
-  ],
-  "version": "6.0.0-alpha3-SNAPSHOT"
-}
\ No newline at end of file
diff --git a/auditbeat/module/audit/_meta/kibana/default/dashboard/auditbeat-file-integrity.json b/auditbeat/module/audit/_meta/kibana/default/dashboard/auditbeat-file-integrity.json
new file mode 100644
index 000000000000..64ef911145ee
--- /dev/null
+++ b/auditbeat/module/audit/_meta/kibana/default/dashboard/auditbeat-file-integrity.json
@@ -0,0 +1,188 @@
+{
+  "objects": [
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Action Metrics",
+        "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Action Metrics\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"gauge\":{\"autoExtend\":false,\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"gaugeColorMode\":\"None\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Metric\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":true,\"width\":2},\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":\"24\",\"labelColor\":false,\"subText\":\"\"},\"type\":\"simple\",\"useRange\":false,\"verticalSplit\":true,\"extendRange\":false},\"type\":\"gauge\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Actions\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"audit.file.action\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tVcg6g1PYniApZa-v",
+      "type": "visualization",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Events over time",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Events over time\",\"type\":\"histogram\",\"params\":{\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{\"text\":\"@timestamp per 5 minutes\"}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"audit.file.action\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Action\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tV05vg1PYniApZbA2",
+      "type": "visualization",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"index\": \"auditbeat-*\",\n  \"query\": {\n    \"query_string\": {\n      \"query\": \"*\",\n      \"analyze_wildcard\": true\n    }\n  },\n  \"filter\": []\n}"
+        },
+        "title": "Auditbeat - File - Top owners",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\n  \"title\": \"Auditbeat - File - Top owners\",\n  \"type\": \"pie\",\n  \"params\": {\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\",\n    \"isDonut\": true\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"audit.file.owner\",\n        \"size\": 5,\n        \"order\": \"desc\",\n        \"orderBy\": \"1\",\n        \"customLabel\": \"Owner\"\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
+      },
+      "id": "AV0tWL-Yg1PYniApZbCs",
+      "type": "visualization",
+      "version": 3
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"index\": \"auditbeat-*\",\n  \"query\": {\n    \"query_string\": {\n      \"query\": \"*\",\n      \"analyze_wildcard\": true\n    }\n  },\n  \"filter\": []\n}"
+        },
+        "title": "Auditbeat - File - Top groups",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\n  \"title\": \"Auditbeat - File - Top groups\",\n  \"type\": \"pie\",\n  \"params\": {\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\",\n    \"isDonut\": true\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"audit.file.group\",\n        \"size\": 5,\n        \"order\": \"desc\",\n        \"orderBy\": \"1\",\n        \"customLabel\": \"Group\"\n      }\n    }\n  ],\n  \"listeners\": {}\n}"
+      },
+      "id": "AV0tWSdXg1PYniApZbDU",
+      "type": "visualization",
+      "version": 3
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"audit.file.action:updated OR audit.file.action:attributes_modified\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Top updated",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Top updated\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"audit.file.path\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Path\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tW0djg1PYniApZbGL",
+      "type": "visualization",
+      "version": 4
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"_exists_:audit.file\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Top agent by count",
+        "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Top agent by count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"gauge\",\"gauge\":{\"verticalSplit\":false,\"autoExtend\":false,\"percentageMode\":false,\"gaugeType\":\"Metric\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"None\",\"useRange\":false,\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":false,\"labels\":false,\"color\":\"#333\",\"width\":2},\"type\":\"simple\",\"style\":{\"fontSize\":\"23\",\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Top agent by count\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"beat.hostname\",\"size\":1,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tY6jwg1PYniApZbRY",
+      "type": "visualization",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"audit.file.type:file\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Most changed file by count",
+        "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Most changed file by count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"gauge\",\"gauge\":{\"verticalSplit\":false,\"autoExtend\":false,\"percentageMode\":false,\"gaugeType\":\"Metric\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"None\",\"useRange\":false,\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":false,\"labels\":false,\"color\":\"#333\",\"width\":2},\"type\":\"simple\",\"style\":{\"fontSize\":\"20\",\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Most changed file by count\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"audit.file.path\",\"size\":1,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tav8Ag1PYniApZbbK",
+      "type": "visualization",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Most common mode by count",
+        "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Most common mode by count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"gauge\",\"gauge\":{\"verticalSplit\":false,\"autoExtend\":false,\"percentageMode\":false,\"gaugeType\":\"Metric\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"None\",\"useRange\":false,\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":false,\"labels\":false,\"color\":\"#333\",\"width\":2},\"type\":\"simple\",\"style\":{\"fontSize\":\"20\",\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Most common mode by count\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"audit.file.mode\",\"size\":1,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tbcUdg1PYniApZbe1",
+      "type": "visualization",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Event summary",
+        "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Event summary\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"beat.hostname\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Hostname\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"audit.file.path\",\"size\":20,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Path\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"audit.file.action\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Action\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tc_xZg1PYniApZbnL",
+      "type": "visualization",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"audit.file.action:deleted\"}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Top deleted",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Top deleted\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":false,\"legendPosition\":\"right\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"audit.file.path\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Path\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0tes4Eg1PYniApZbwV",
+      "type": "visualization",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"auditbeat-*\",\"query\":{\"query_string\":{\"query\":\"audit.file.action:created\",\"analyze_wildcard\":true}},\"filter\":[]}"
+        },
+        "title": "Auditbeat - File - Top created",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Auditbeat - File - Top created\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":false,\"legendPosition\":\"right\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"audit.file.path\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Path\"}}],\"listeners\":{}}"
+      },
+      "id": "AV0te0TCg1PYniApZbw9",
+      "type": "visualization",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}],\"highlightAll\":true,\"version\":true}"
+        },
+        "optionsJSON": "{\"darkTheme\":false}",
+        "panelsJSON": "[{\"col\":1,\"id\":\"AV0tVcg6g1PYniApZa-v\",\"panelIndex\":1,\"row\":1,\"size_x\":2,\"size_y\":6,\"type\":\"visualization\"},{\"col\":3,\"id\":\"AV0tV05vg1PYniApZbA2\",\"panelIndex\":2,\"row\":1,\"size_x\":7,\"size_y\":6,\"type\":\"visualization\"},{\"col\":10,\"id\":\"AV0tWL-Yg1PYniApZbCs\",\"panelIndex\":3,\"row\":1,\"size_x\":3,\"size_y\":3,\"type\":\"visualization\"},{\"col\":10,\"id\":\"AV0tWSdXg1PYniApZbDU\",\"panelIndex\":4,\"row\":4,\"size_x\":3,\"size_y\":3,\"type\":\"visualization\"},{\"col\":5,\"id\":\"AV0tW0djg1PYniApZbGL\",\"panelIndex\":5,\"row\":9,\"size_x\":4,\"size_y\":3,\"type\":\"visualization\"},{\"col\":1,\"id\":\"AV0tY6jwg1PYniApZbRY\",\"panelIndex\":6,\"row\":7,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":5,\"id\":\"AV0tav8Ag1PYniApZbbK\",\"panelIndex\":7,\"row\":7,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":9,\"id\":\"AV0tbcUdg1PYniApZbe1\",\"panelIndex\":8,\"row\":7,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"size_x\":12,\"size_y\":5,\"panelIndex\":9,\"type\":\"visualization\",\"id\":\"AV0tc_xZg1PYniApZbnL\",\"col\":1,\"row\":12},{\"size_x\":4,\"size_y\":3,\"panelIndex\":10,\"type\":\"visualization\",\"id\":\"AV0tes4Eg1PYniApZbwV\",\"col\":9,\"row\":9},{\"size_x\":4,\"size_y\":3,\"panelIndex\":11,\"type\":\"visualization\",\"id\":\"AV0te0TCg1PYniApZbw9\",\"col\":1,\"row\":9}]",
+        "timeRestore": false,
+        "title": "Auditbeat - File Integrity",
+        "uiStateJSON": "{\"P-1\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"P-6\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"P-7\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"P-8\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"P-9\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}",
+        "version": 1
+      },
+      "id": "AV0tXkjYg1PYniApZbKP",
+      "type": "dashboard",
+      "version": 7
+    }
+  ],
+  "version": "6.0.0-alpha3-SNAPSHOT"
+}
\ No newline at end of file
diff --git a/auditbeat/module/audit/file/_meta/data.json b/auditbeat/module/audit/file/_meta/data.json
index f4bfaa2b931a..670ce721274a 100644
--- a/auditbeat/module/audit/file/_meta/data.json
+++ b/auditbeat/module/audit/file/_meta/data.json
@@ -1,20 +1,23 @@
 {
-    "@timestamp": "2017-06-27T02:47:41.347Z",
+    "@timestamp": "2017-07-10T18:13:08.197Z",
     "audit": {
         "file": {
             "action": "created",
-            "atime": "2017-06-26T22:47:40-04:00",
-            "ctime": "2017-06-26T22:47:40-04:00",
+            "atime": "2017-07-10T18:13:08Z",
+            "ctime": "2017-07-10T18:13:08Z",
             "gid": 20,
+            "group": "staff",
             "hashed": true,
-            "inode": 11290505,
+            "inode": "11706872",
             "md5": "5eb63bbbe01eeed093cb22bb8f5acdc3",
             "mode": "0600",
-            "mtime": "2017-06-26T22:47:40-04:00",
-            "path": "/private/var/folders/8x/rnyk6yxn6w97lddn3bs02gf00000gn/T/audit-file189170857/file.data",
+            "mtime": "2017-07-10T18:13:08Z",
+            "owner": "akroh",
+            "path": "/var/folders/8x/rnyk6yxn6w97lddn3bs02gf00000gn/T/audit-file232876074/file.data",
             "sha1": "2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
             "sha256": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9",
             "size": 11,
+            "type": "file",
             "uid": 501
         }
     },
diff --git a/auditbeat/module/audit/file/_meta/fields.yml b/auditbeat/module/audit/file/_meta/fields.yml
index 754324b47eab..af9de7bb9248 100644
--- a/auditbeat/module/audit/file/_meta/fields.yml
+++ b/auditbeat/module/audit/file/_meta/fields.yml
@@ -6,13 +6,18 @@
     - name: path
       type: keyword
       description: The path to the file.
+    - name: target_path
+      type: keyword
+      description: The target path for symlinks.
     - name: action
       type: keyword
       example: attributes_modified
       description: >
         Action describes the change to the file. The possible values are:
-        attributes_modified, created, deleted, updated, moved_to,
-        collision_within, unmounted, root_changed.
+        attributes_modified, created, deleted, updated, and moved.
+    - name: type
+      type: keyword
+      description: The file type (file, dir, or symlink).
     - name: inode
       type: keyword
       description: The inode representing the file in the filesystem.
@@ -28,6 +33,9 @@
     - name: group
       type: keyword
       description: The primary group name of the file.
+    - name: sid
+      type: keyword
+      description: The security identifier (SID) of the file owner (Windows only).
     - name: mode
       type: keyword
       example: 0640
@@ -49,4 +57,14 @@
       description: >
         Boolean indicating if the event includes a file hashes. If true the
         md5, sha1, and sha256 fields will be present.
+    - name: md5
+      type: keyword
+      description: MD5 hash of the file.
+    - name: sha1
+      type: keyword
+      description: SHA1 hash of the file.
+    - name: sha256
+      type: keyword
+      description: SHA256 hash of the file.
+
 
diff --git a/auditbeat/module/audit/file/event.go b/auditbeat/module/audit/file/event.go
index 9082a0487195..9fec4e76871b 100644
--- a/auditbeat/module/audit/file/event.go
+++ b/auditbeat/module/audit/file/event.go
@@ -5,15 +5,18 @@ import (
 	"crypto/sha1"
 	"crypto/sha256"
 	"encoding/hex"
+	"fmt"
 	"io"
 	"os"
+	"runtime"
+	"strconv"
 	"time"
 
-	"github.com/pkg/errors"
-
 	"github.com/elastic/beats/libbeat/common"
+	"github.com/pkg/errors"
 )
 
+// Action is a description of the change that occurred.
 type Action uint8
 
 func (a Action) String() string {
@@ -23,16 +26,14 @@ func (a Action) String() string {
 	return "unknown"
 }
 
+// List of possible Actions.
 const (
-	Unknown = iota << 1
+	Unknown Action = iota << 1
 	AttributesModified
 	Created
 	Deleted
 	Updated
-	MovedTo
-	CollisionWithin
-	Unmounted
-	RootChanged
+	Moved
 )
 
 var actionNames = map[Action]string{
@@ -40,30 +41,38 @@ var actionNames = map[Action]string{
 	Created:            "created",
 	Deleted:            "deleted",
 	Updated:            "updated",
-	MovedTo:            "moved_to",
-	CollisionWithin:    "collision_within",
-	Unmounted:          "unmounted",
-	RootChanged:        "root_changed",
+	Moved:              "moved",
 }
 
+// Event describe the filesystem change and includes metadata about the file.
 type Event struct {
-	Path      string    `structs:"path"`   // The path associated with the event.
-	Action    string    `structs:"action"` // Action (like created, updated).
-	Inode     uint64    `structs:"inode"`
-	UID       int32     `structs:"uid"`
-	GID       int32     `structs:"gid"`
-	Owner     string    `structs:"owner,omitempty"`
-	Group     string    `structs:"group,omitempty"`
-	Mode      string    `structs:"mode"`
-	Size      int64     `structs:"size"`
-	ATime     time.Time `structs:"atime"` // Last access time.
-	MTime     time.Time `structs:"mtime"` // Last modification time.
-	CTime     time.Time `structs:"ctime"` // Last status change time.
-	MD5       string    `structs:"md5,omitempty"`
-	SHA1      string    `structs:"sha1,omitempty"`
-	SHA256    string    `structs:"sha256,omitempty"`
-	Hashed    bool      `structs:"hashed"`     // True if hashed.
-	Timestamp time.Time `structs:"@timestamp"` // Time of event.
+	Timestamp  time.Time // Time of event.
+	Path       string    // The path associated with the event.
+	TargetPath string    // Target path for symlinks.
+	Action     string    // Action (like created, updated).
+	Info       *Metadata // File metadata (if the file exists).
+	Hashed     bool      // True if hashed.
+	MD5        string
+	SHA1       string
+	SHA256     string
+
+	errors []error
+}
+
+// Metadata contains file metadata.
+type Metadata struct {
+	Inode uint64
+	UID   uint32
+	GID   uint32
+	SID   string
+	Owner string
+	Group string
+	Mode  os.FileMode
+	Size  int64
+	ATime time.Time // Last access time.
+	MTime time.Time // Last modification time.
+	CTime time.Time // Last status change time.
+	Type  string    // File type (dir, file, symlink).
 }
 
 func buildMapStr(e *Event) common.MapStr {
@@ -71,23 +80,43 @@ func buildMapStr(e *Event) common.MapStr {
 		"@timestamp": e.Timestamp,
 		"path":       e.Path,
 		"action":     e.Action,
-		"inode":      e.Inode,
-		"uid":        e.UID,
-		"gid":        e.GID,
-		"mode":       e.Mode,
-		"size":       e.Size,
-		"atime":      e.ATime,
-		"mtime":      e.MTime,
-		"ctime":      e.CTime,
 		"hashed":     e.Hashed,
 	}
 
-	if e.Owner != "" {
-		m["owner"] = e.Owner
+	if e.TargetPath != "" {
+		m["target_path"] = e.TargetPath
 	}
-	if e.Group != "" {
-		m["group"] = e.Group
+
+	if e.Info != nil {
+		info := e.Info
+		m["inode"] = strconv.FormatUint(info.Inode, 10)
+		m["size"] = info.Size
+		m["atime"] = info.ATime
+		m["mtime"] = info.MTime
+		m["ctime"] = info.CTime
+
+		if info.Type != "" {
+			m["type"] = info.Type
+		}
+
+		if runtime.GOOS == "windows" {
+			if info.SID != "" {
+				m["sid"] = info.SID
+			}
+		} else {
+			m["uid"] = info.UID
+			m["gid"] = info.GID
+			m["mode"] = fmt.Sprintf("%#04o", uint32(info.Mode))
+		}
+
+		if info.Owner != "" {
+			m["owner"] = info.Owner
+		}
+		if info.Group != "" {
+			m["group"] = info.Group
+		}
 	}
+
 	if e.Hashed {
 		m["md5"] = e.MD5
 		m["sha1"] = e.SHA1
diff --git a/auditbeat/module/audit/file/eventreader_darwin.go b/auditbeat/module/audit/file/eventreader_darwin.go
deleted file mode 100644
index e64a2ee56645..000000000000
--- a/auditbeat/module/audit/file/eventreader_darwin.go
+++ /dev/null
@@ -1,86 +0,0 @@
-package file
-
-import (
-	"time"
-
-	"github.com/fsnotify/fsevents"
-)
-
-func NewEventReader(c Config) (EventReader, error) {
-	var paths []string
-	for _, filePaths := range c.Paths {
-		paths = append(paths, filePaths...)
-	}
-
-	es := &fsevents.EventStream{
-		Paths:   paths,
-		Latency: 500 * time.Millisecond,
-		Flags:   fsevents.FileEvents | fsevents.WatchRoot,
-	}
-
-	return &reader{es, c.MaxFileSize, make(chan Event, 1)}, nil
-}
-
-type reader struct {
-	stream      *fsevents.EventStream
-	maxFileSize int64
-	out         chan Event
-}
-
-func (r *reader) Start(done <-chan struct{}) (<-chan Event, error) {
-	r.stream.Start()
-	ec := r.stream.Events
-
-	go func() {
-		defer r.stream.Stop()
-
-		for {
-			select {
-			case <-done:
-				return
-			case events := <-ec:
-				for _, e := range events {
-					r.out <- convertToFileEvent(e, r.maxFileSize)
-				}
-			}
-		}
-	}()
-
-	return r.out, nil
-}
-
-func convertToFileEvent(e fsevents.Event, maxFileSize int64) Event {
-	event := Event{
-		Timestamp: time.Now(),
-		Path:      e.Path,
-		Action:    flagsToAction(e.Flags).String(),
-	}
-
-	addFileAttributes(&event, maxFileSize)
-
-	return event
-}
-
-func flagsToAction(f fsevents.EventFlags) Action {
-	switch {
-	case f&fsevents.ItemCreated > 0:
-		return Created
-	case f&fsevents.ItemModified > 0:
-		return Updated
-	case f&fsevents.ItemRemoved > 0:
-		return Deleted
-	case f&fsevents.ItemRenamed > 0:
-		return MovedTo
-	case f&fsevents.ItemChangeOwner > 0,
-		f&fsevents.ItemInodeMetaMod > 0,
-		f&fsevents.ItemXattrMod > 0,
-		f&fsevents.ItemFinderInfoMod > 0:
-		return AttributesModified
-	case f&fsevents.Unmount > 0:
-		return Unmounted
-	case f&fsevents.MustScanSubDirs > 0:
-		return CollisionWithin
-	default:
-		return Unknown
-	}
-}
diff --git a/auditbeat/module/audit/file/eventreader_fsnotify.go b/auditbeat/module/audit/file/eventreader_fsnotify.go
new file mode 100644
index 000000000000..e3c1b0c2ed12
--- /dev/null
+++ b/auditbeat/module/audit/file/eventreader_fsnotify.go
@@ -0,0 +1,119 @@
+// +build linux freebsd openbsd netbsd windows darwin
+
+package file
+
+import (
+	"path/filepath"
+	"syscall"
+	"time"
+
+	"github.com/elastic/beats/libbeat/logp"
+	"github.com/fsnotify/fsnotify"
+)
+
+// NewEventReader creates a new EventReader backed by fsnotify.
+func NewEventReader(c Config) (EventReader, error) {
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, err
+	}
+
+	return &reader{watcher, c, make(chan Event, 1), make(chan error, 1)}, nil
+}
+
+type reader struct {
+	watcher *fsnotify.Watcher
+	config  Config
+	outC    chan Event
+	errC    chan error
+}
+
+func (r *reader) Start(done <-chan struct{}) (<-chan Event, error) {
+	var paths []string
+	for _, filePaths := range r.config.Paths {
+		paths = append(paths, filePaths...)
+	}
+
+	for _, p := range paths {
+		if err := r.watcher.Add(p); err != nil {
+			if err == syscall.EMFILE {
+				logp.Warn("%v Failed to watch %v: %v (check the max number of "+
+					"open files allowed with 'ulimit -a')", logPrefix, p, err)
+			} else {
+				logp.Warn("%v Failed to watch %v: %v", logPrefix, p, err)
+			}
+		}
+	}
+
+	go func() {
+		defer close(r.outC)
+		defer r.watcher.Close()
+
+		for {
+			select {
+			case event := <-r.watcher.Events:
+				if event.Name == "" {
+					continue
+				}
+				r.outC <- convertToFileEvent(event, r.config.MaxFileSize)
+			case err := <-r.watcher.Errors:
+				r.errC <- err
+			}
+		}
+	}()
+
+	return r.outC, nil
+}
+
+func convertToFileEvent(e fsnotify.Event, maxFileSize int64) Event {
+	event := Event{
+		Timestamp: time.Now().UTC(),
+		Path:      e.Name,
+		Action:    opToAction(e.Op).String(),
+	}
+
+	var err error
+	event.Info, err = Stat(event.Path)
+	if err != nil {
+		event.errors = append(event.errors, err)
+	}
+	if event.Info == nil {
+		return event
+	}
+
+	switch event.Info.Type {
+	case "file":
+		if event.Info.Size <= maxFileSize {
+			md5sum, sha1sum, sha256sum, err := hashFile(event.Path)
+			if err != nil {
+				event.errors = append(event.errors, err)
+			} else {
+				event.MD5 = md5sum
+				event.SHA1 = sha1sum
+				event.SHA256 = sha256sum
+				event.Hashed = true
+			}
+		}
+	case "symlink":
+		event.TargetPath, _ = filepath.EvalSymlinks(event.Path)
+	}
+
+	return event
+}
+
+func opToAction(op fsnotify.Op) Action {
+	switch op {
+	case fsnotify.Create:
+		return Created
+	case fsnotify.Write:
+		return Updated
+	case fsnotify.Remove:
+		return Deleted
+	case fsnotify.Rename:
+		return Moved
+	case fsnotify.Chmod:
+		return AttributesModified
+	default:
+		return Unknown
+	}
+}
diff --git a/auditbeat/module/audit/file/eventreader_other.go b/auditbeat/module/audit/file/eventreader_other.go
deleted file mode 100644
index 97e0cfe65554..000000000000
--- a/auditbeat/module/audit/file/eventreader_other.go
+++ /dev/null
@@ -1,83 +0,0 @@
-// +build linux freebsd openbsd netbsd windows
-
-package file
-
-import (
-	"time"
-
-	"github.com/fsnotify/fsnotify"
-)
-
-func NewEventReader(c Config) (EventReader, error) {
-	var paths []string
-	for _, filePaths := range c.Paths {
-		paths = append(paths, filePaths...)
-	}
-
-	watcher, err := fsnotify.NewWatcher()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, p := range paths {
-		if err := watcher.Add(p); err != nil {
-			watcher.Close()
-			return nil, err
-		}
-	}
-
-	return &reader{watcher, c.MaxFileSize, make(chan Event, 1), make(chan error, 1)}, nil
-}
-
-type reader struct {
-	watcher     *fsnotify.Watcher
-	maxFileSize int64
-	outC        chan Event
-	errC        chan error
-}
-
-func (r *reader) Start(done <-chan struct{}) (<-chan Event, error) {
-	go func() {
-		defer r.watcher.Close()
-
-		for {
-			select {
-			case event := <-r.watcher.Events:
-				r.outC <- convertToFileEvent(event, r.maxFileSize)
-			case err := <-r.watcher.Errors:
-				r.errC <- err
-			}
-		}
-	}()
-
-	return r.outC, nil
-}
-
-func convertToFileEvent(e fsnotify.Event, maxFileSize int64) Event {
-	event := Event{
-		Timestamp: time.Now(),
-		Path:      e.Name,
-		Action:    opToAction(e.Op).String(),
-	}
-
-	addFileAttributes(&event, maxFileSize)
-
-	return event
-}
-
-func opToAction(op fsnotify.Op) Action {
-	switch op {
-	case fsnotify.Create:
-		return Created
-	case fsnotify.Write:
-		return Updated
-	case fsnotify.Remove:
-		return Deleted
-	case fsnotify.Rename:
-		return MovedTo
-	case fsnotify.Chmod:
-		return AttributesModified
-	default:
-		return Unknown
-	}
-}
diff --git a/auditbeat/module/audit/file/fileinfo_bsd.go b/auditbeat/module/audit/file/fileinfo_bsd.go
index 7f7dfa321d4d..fe84fe8836b1 100644
--- a/auditbeat/module/audit/file/fileinfo_bsd.go
+++ b/auditbeat/module/audit/file/fileinfo_bsd.go
@@ -3,43 +3,12 @@
 package file
 
 import (
-	"fmt"
-	"os"
 	"syscall"
 	"time"
-
-	"github.com/pkg/errors"
 )
 
-func addFileAttributes(e *Event, maxFileSize int64) error {
-	info, err := os.Lstat(e.Path)
-	if err != nil {
-		return errors.Wrap(err, "failed to stat file")
-	}
-
-	stat, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.Errorf("unexpected fileinfo sys type %T", info.Sys())
-	}
-
-	e.Inode = stat.Ino
-	e.UID = int32(stat.Uid)
-	e.GID = int32(stat.Gid)
-	e.Mode = fmt.Sprintf("%#o", uint32(info.Mode()))
-	e.Size = info.Size()
-	e.ATime = time.Unix(0, stat.Atimespec.Nano())
-	e.MTime = time.Unix(0, stat.Mtimespec.Nano())
-	e.CTime = time.Unix(0, stat.Ctimespec.Nano())
-
-	if e.Size <= maxFileSize {
-		md5sum, sha1sum, sha256sum, err := hashFile(e.Path)
-		if err == nil {
-			e.MD5 = md5sum
-			e.SHA1 = sha1sum
-			e.SHA256 = sha256sum
-			e.Hashed = true
-		}
-	}
-
-	return nil
+func fileTimes(stat *syscall.Stat_t) (atime, mtime, ctime time.Time) {
+	return time.Unix(0, stat.Atimespec.Nano()).UTC(),
+		time.Unix(0, stat.Mtimespec.Nano()).UTC(),
+		time.Unix(0, stat.Mtimespec.Nano()).UTC()
 }
diff --git a/auditbeat/module/audit/file/fileinfo_linux.go b/auditbeat/module/audit/file/fileinfo_linux.go
index 67b80df9c6ad..418e5cbdf6ac 100644
--- a/auditbeat/module/audit/file/fileinfo_linux.go
+++ b/auditbeat/module/audit/file/fileinfo_linux.go
@@ -1,43 +1,14 @@
+// +build linux
+
 package file
 
 import (
-	"fmt"
-	"os"
 	"syscall"
 	"time"
-
-	"github.com/pkg/errors"
 )
 
-func addFileAttributes(e *Event, maxFileSize int64) error {
-	info, err := os.Lstat(e.Path)
-	if err != nil {
-		return errors.Wrap(err, "failed to stat file")
-	}
-
-	stat, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.Errorf("unexpected fileinfo sys type %T", info.Sys())
-	}
-
-	e.Inode = stat.Ino
-	e.UID = int32(stat.Uid)
-	e.GID = int32(stat.Gid)
-	e.Mode = fmt.Sprintf("%#o", uint32(info.Mode()))
-	e.Size = info.Size()
-	e.ATime = time.Unix(0, stat.Atim.Nano())
-	e.MTime = time.Unix(0, stat.Mtim.Nano())
-	e.CTime = time.Unix(0, stat.Ctim.Nano())
-
-	if e.Size <= maxFileSize {
-		md5sum, sha1sum, sha256sum, err := hashFile(e.Path)
-		if err == nil {
-			e.MD5 = md5sum
-			e.SHA1 = sha1sum
-			e.SHA256 = sha256sum
-			e.Hashed = true
-		}
-	}
-
-	return nil
+func fileTimes(stat *syscall.Stat_t) (atime, mtime, ctime time.Time) {
+	return time.Unix(0, stat.Atim.Nano()).UTC(),
+		time.Unix(0, stat.Mtim.Nano()).UTC(),
+		time.Unix(0, stat.Ctim.Nano()).UTC()
 }
diff --git a/auditbeat/module/audit/file/fileinfo_windows.go b/auditbeat/module/audit/file/fileinfo_windows.go
index 29f3cbac03eb..70779a4a7056 100644
--- a/auditbeat/module/audit/file/fileinfo_windows.go
+++ b/auditbeat/module/audit/file/fileinfo_windows.go
@@ -3,45 +3,86 @@
 package file
 
 import (
+	"fmt"
 	"os"
-	"reflect"
 	"syscall"
 	"time"
+	"unsafe"
 
+	"github.com/elastic/beats/filebeat/input/file"
+	"github.com/joeshaw/multierror"
 	"github.com/pkg/errors"
 )
 
-func addFileAttributes(e *Event, maxFileSize int64) error {
-	info, err := os.Lstat(e.Path)
+func Stat(path string) (*Metadata, error) {
+	info, err := os.Lstat(path)
 	if err != nil {
-		return errors.Wrap(err, "failed to stat file")
+		return nil, errors.Wrap(err, "failed to stat path")
 	}
 
 	attrs, ok := info.Sys().(*syscall.Win32FileAttributeData)
 	if !ok {
-		return errors.Errorf("unexpected fileinfo sys type %T", info.Sys())
+		return nil, errors.Errorf("unexpected fileinfo sys type %T for %v", info.Sys(), path)
 	}
 
-	fileStat := reflect.ValueOf(info).Elem()
-	idxhi := uint32(fileStat.FieldByName("idxhi").Uint())
-	idxlo := uint32(fileStat.FieldByName("idxlo").Uint())
+	state := file.GetOSState(info)
 
-	e.Inode = uint64(idxhi<<32 + idxlo)
-	e.Size = info.Size()
-	// TODO: Add owner.
-	e.ATime = time.Unix(0, attrs.LastAccessTime.Nanoseconds())
-	e.MTime = time.Unix(0, attrs.LastWriteTime.Nanoseconds())
-	e.CTime = time.Unix(0, attrs.CreationTime.Nanoseconds())
+	fileInfo := &Metadata{
+		Inode: uint64(state.IdxHi<<32 + state.IdxLo),
+		Mode:  info.Mode(),
+		Size:  info.Size(),
+		ATime: time.Unix(0, attrs.LastAccessTime.Nanoseconds()).UTC(),
+		MTime: time.Unix(0, attrs.LastWriteTime.Nanoseconds()).UTC(),
+		CTime: time.Unix(0, attrs.CreationTime.Nanoseconds()).UTC(),
+	}
+
+	switch {
+	case info.IsDir():
+		fileInfo.Type = "dir"
+	case info.Mode().IsRegular():
+		fileInfo.Type = "file"
+	case info.Mode()&os.ModeSymlink > 0:
+		fileInfo.Type = "symlink"
+	}
+
+	// fileOwner only works on files or symlinks to file because os.Open only
+	// works on files. To open a dir we need to use CreateFile with the
+	// FILE_FLAG_BACKUP_SEMANTICS flag.
+	if !info.IsDir() {
+		fileInfo.SID, fileInfo.Owner, err = fileOwner(path)
+	}
+	return fileInfo, err
+}
+
+func fileOwner(path string) (sid, owner string, err error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", "", errors.Wrap(err, "failed to open file to get owner")
+	}
+	defer f.Close()
+
+	var securityID *syscall.SID
+	var securityDescriptor *SecurityDescriptor
+
+	if err := GetSecurityInfo(syscall.Handle(f.Fd()), FileObject,
+		OwnerSecurityInformation, &securityID, nil, nil, nil, &securityDescriptor); err != nil {
+		return "", "", errors.Wrapf(err, "failed on GetSecurityInfo for %v", path)
+	}
+	defer syscall.LocalFree((syscall.Handle)(unsafe.Pointer(securityDescriptor)))
 
-	if e.Size <= maxFileSize {
-		md5sum, sha1sum, sha256sum, err := hashFile(e.Path)
-		if err == nil {
-			e.MD5 = md5sum
-			e.SHA1 = sha1sum
-			e.SHA256 = sha256sum
-			e.Hashed = true
-		}
+	// Covert SID to a string and lookup the username.
+	var errs multierror.Errors
+	sid, err = securityID.String()
+	if err != nil {
+		errs = append(errs, err)
+	}
+
+	account, domain, _, err := securityID.LookupAccount("")
+	if err != nil {
+		errs = append(errs, err)
+	} else {
+		owner = fmt.Sprintf(`%s\%s`, domain, account)
 	}
 
-	return nil
+	return sid, owner, errs.Err()
 }
diff --git a/auditbeat/module/audit/file/filepath_posix.go b/auditbeat/module/audit/file/filepath_posix.go
new file mode 100644
index 000000000000..a58bfce5d3a2
--- /dev/null
+++ b/auditbeat/module/audit/file/filepath_posix.go
@@ -0,0 +1,61 @@
+// +build linux freebsd openbsd netbsd darwin
+
+package file
+
+import (
+	"os"
+	"os/user"
+	"strconv"
+	"syscall"
+
+	"github.com/joeshaw/multierror"
+	"github.com/pkg/errors"
+)
+
+func Stat(path string) (*Metadata, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to stat path")
+	}
+
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return nil, errors.Errorf("unexpected fileinfo sys type %T for %v", info.Sys(), path)
+	}
+
+	fileInfo := &Metadata{
+		Inode: stat.Ino,
+		UID:   stat.Uid,
+		GID:   stat.Gid,
+		Mode:  info.Mode(),
+		Size:  info.Size(),
+	}
+	fileInfo.ATime, fileInfo.MTime, fileInfo.CTime = fileTimes(stat)
+
+	switch {
+	case info.IsDir():
+		fileInfo.Type = "dir"
+	case info.Mode().IsRegular():
+		fileInfo.Type = "file"
+	case info.Mode()&os.ModeSymlink > 0:
+		fileInfo.Type = "symlink"
+	}
+
+	// Lookup UID and GID
+	var errs multierror.Errors
+	owner, err := user.LookupId(strconv.Itoa(int(fileInfo.UID)))
+	if err != nil {
+		errs = append(errs, err)
+	} else {
+		fileInfo.Owner = owner.Username
+	}
+
+	group, err := user.LookupGroupId(strconv.Itoa(int(fileInfo.GID)))
+	if err != nil {
+		errs = append(errs, err)
+	} else {
+		fileInfo.Group = group.Name
+	}
+
+	return fileInfo, errs.Err()
+}
diff --git a/auditbeat/module/audit/file/metricset.go b/auditbeat/module/audit/file/metricset.go
index d570b7a9eba7..f288457ec4a4 100644
--- a/auditbeat/module/audit/file/metricset.go
+++ b/auditbeat/module/audit/file/metricset.go
@@ -30,6 +30,10 @@ type Config struct {
 	MaxFileSize int64               `config:"max_file_size"`
 }
 
+var defaultConfig = Config{
+	MaxFileSize: 1 << 30, // 1 Gibibyte
+}
+
 type EventReader interface {
 	Start(done <-chan struct{}) (<-chan Event, error)
 }
@@ -43,9 +47,7 @@ type MetricSet struct {
 func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	logp.Experimental("The %v metricset is an experimental feature", metricsetName)
 
-	config := Config{
-		MaxFileSize: 1 << 30, // 1 Gibibyte
-	}
+	config := defaultConfig
 	if err := base.Module().UnpackConfig(&config); err != nil {
 		return nil, err
 	}
@@ -76,6 +78,11 @@ func (ms *MetricSet) Run(reporter mb.PushReporter) {
 			return
 		case event := <-eventChan:
 			reporter.Event(buildMapStr(&event))
+
+			if len(event.errors) > 0 {
+				debugf("%v Errors on %v event for %v: %v",
+					logPrefix, event.Action, event.Path, event.errors)
+			}
 		}
 	}
 }
diff --git a/auditbeat/module/audit/file/metricset_test.go b/auditbeat/module/audit/file/metricset_test.go
index b58469eb4711..26e0ba4e9e64 100644
--- a/auditbeat/module/audit/file/metricset_test.go
+++ b/auditbeat/module/audit/file/metricset_test.go
@@ -4,9 +4,13 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 	"time"
 
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
+
 	mbtest "github.com/elastic/beats/metricbeat/mb/testing"
 )
 
@@ -45,3 +49,258 @@ func getConfig(path string) map[string]interface{} {
 		},
 	}
 }
+
+func TestEventReader(t *testing.T) {
+	// Make dir to monitor.
+	dir, err := ioutil.TempDir("", "audit")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+
+	// Create a new EventReader.
+	config := defaultConfig
+	config.Paths = map[string][]string{
+		"testdir": {dir},
+	}
+	r, err := NewEventReader(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	done := make(chan struct{})
+	defer close(done)
+	events, err := r.Start(done)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a new file.
+	txt1 := filepath.Join(dir, "test1.txt")
+	var fileMode os.FileMode = 0640
+	t.Run("created", func(t *testing.T) {
+		if err = ioutil.WriteFile(txt1, []byte("hello"), fileMode); err != nil {
+			t.Fatal(err)
+		}
+
+		event := readTimeout(t, events)
+		assert.Equal(t, Created.String(), event.Action)
+		assertSameFile(t, txt1, event.Path)
+		if runtime.GOOS != "windows" {
+			assert.EqualValues(t, fileMode, event.Info.Mode)
+		}
+	})
+
+	// Rename the file.
+	txt2 := filepath.Join(dir, "test2.txt")
+	t.Run("move", func(t *testing.T) {
+		if err = os.Rename(txt1, txt2); err != nil {
+			t.Fatal(err)
+		}
+
+		if runtime.GOOS == "windows" {
+			updated := readTimeout(t, events)
+			assert.Equal(t, Updated.String(), updated.Action)
+		}
+
+		// The order isn't guaranteed.
+		created := readTimeout(t, events)
+		moved := readTimeout(t, events)
+		if created.Action != Created.String() {
+			tmp := moved
+			moved = created
+			created = tmp
+		}
+
+		assert.Equal(t, Moved.String(), moved.Action)
+		assert.Equal(t, txt1, moved.Path)
+
+		assert.Equal(t, Created.String(), created.Action)
+		assertSameFile(t, txt2, created.Path)
+	})
+
+	// Chmod the file.
+	t.Run("attributes modified", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip()
+		}
+
+		if err = os.Chmod(txt2, 0644); err != nil {
+			t.Fatal(err)
+		}
+
+		event := readTimeout(t, events)
+		assertSameFile(t, txt2, event.Path)
+		assert.Equal(t, AttributesModified.String(), event.Action)
+		assert.EqualValues(t, 0644, event.Info.Mode)
+	})
+
+	// Append data to the file.
+	t.Run("updated", func(t *testing.T) {
+		f, err := os.OpenFile(txt2, os.O_RDWR|os.O_APPEND, fileMode)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.WriteString(" world!")
+		f.Sync()
+		f.Close()
+
+		event := readTimeout(t, events)
+		assertSameFile(t, txt2, event.Path)
+		assert.Equal(t, Updated.String(), event.Action)
+		if runtime.GOOS != "windows" {
+			assert.EqualValues(t, 0644, event.Info.Mode)
+		}
+	})
+
+	// Change the GID of the file.
+	t.Run("chown", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("skip chown on windows")
+		}
+
+		gid := changeGID(t, txt2)
+		event := readTimeout(t, events)
+		assertSameFile(t, txt2, event.Path)
+		assert.Equal(t, AttributesModified.String(), event.Action)
+		assert.EqualValues(t, gid, event.Info.GID)
+	})
+
+	t.Run("deleted", func(t *testing.T) {
+		if err = os.Remove(txt2); err != nil {
+			t.Fatal(err)
+		}
+
+		event := readTimeout(t, events)
+		assert.Equal(t, Deleted.String(), event.Action)
+	})
+
+	// Create a sub-directory.
+	subDir := filepath.Join(dir, "subdir")
+	t.Run("dir created", func(t *testing.T) {
+		if err = os.Mkdir(subDir, 0755); err != nil {
+			t.Fatal(err)
+		}
+
+		event := readTimeout(t, events)
+		assertSameFile(t, subDir, event.Path)
+	})
+
+	// Test that it does not monitor recursively.
+	subFile := filepath.Join(subDir, "foo.txt")
+	t.Run("non-recursive", func(t *testing.T) {
+		if err = ioutil.WriteFile(subFile, []byte("foo"), fileMode); err != nil {
+			t.Fatal(err)
+		}
+
+		assertNoEvent(t, events)
+	})
+
+	// Test moving a file into the monitored dir from outside.
+	var moveInOrig string
+	moveIn := filepath.Join(dir, "test3.txt")
+	t.Run("move in", func(t *testing.T) {
+		f, err := ioutil.TempFile("", "test3.txt")
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.WriteString("move-in")
+		f.Sync()
+		f.Close()
+		moveInOrig = f.Name()
+
+		if err = os.Rename(moveInOrig, moveIn); err != nil {
+			t.Fatal(err)
+		}
+
+		event := readTimeout(t, events)
+		assert.Equal(t, Created.String(), event.Action)
+		assertSameFile(t, moveIn, event.Path)
+	})
+
+	// Test moving a file out of the monitored dir.
+	t.Run("move out", func(t *testing.T) {
+		if err = os.Rename(moveIn, moveInOrig); err != nil {
+			t.Fatal(err)
+		}
+		defer os.Remove(moveInOrig)
+
+		event := readTimeout(t, events)
+		assertSameFile(t, moveIn, event.Path)
+		if runtime.GOOS == "windows" {
+			assert.Equal(t, Deleted.String(), event.Action)
+		} else {
+			assert.Equal(t, Moved.String(), event.Action)
+		}
+	})
+}
+
+// readTimeout reads one event from the channel and returns it. If it does
+// not receive an event after one second it will time-out and fail the test.
+func readTimeout(t testing.TB, events <-chan Event) Event {
+	select {
+	case e, ok := <-events:
+		if !ok {
+			t.Fatal("failed reading from event channel")
+		}
+		t.Logf("%+v", buildMapStr(&e).StringToPrint())
+		return e
+	case <-time.After(time.Second):
+		t.Fatalf("%+v", errors.Errorf("timed-out waiting for event"))
+	}
+
+	return Event{}
+}
+
+// assertNoEvent asserts that no event is received on the channel. It waits for
+// 250ms.
+func assertNoEvent(t testing.TB, events <-chan Event) {
+	select {
+	case e := <-events:
+		t.Fatal("received unexpected event", e)
+	case <-time.After(250 * time.Millisecond):
+	}
+}
+
+// assertSameFile asserts that two files are the same.
+func assertSameFile(t testing.TB, f1, f2 string) {
+	if f1 == f2 {
+		return
+	}
+
+	info1, err := os.Lstat(f1)
+	if err != nil {
+		t.Error(err)
+		return
+	}
+
+	info2, err := os.Lstat(f2)
+	if err != nil {
+		t.Error(err)
+		return
+	}
+
+	assert.True(t, os.SameFile(info1, info2), "%v and %v are not the same file", f1, f2)
+}
+
+// changeGID changes the GID of a file using chown. It uses the second group
+// that the user is a member of. If the user is only a member of one group then
+// it will skip the test.
+func changeGID(t testing.TB, file string) int {
+	groups, err := os.Getgroups()
+	if err != nil {
+		t.Fatal("failed to get groups", err)
+	}
+
+	if len(groups) <= 1 {
+		t.Skip("no group that we can change to")
+	}
+
+	// The second one will be a non-default group.
+	gid := groups[1]
+	if err = os.Chown(file, -1, gid); err != nil {
+		t.Fatal(err)
+	}
+
+	return gid
+}
diff --git a/auditbeat/module/audit/file/security_windows.go b/auditbeat/module/audit/file/security_windows.go
new file mode 100644
index 000000000000..29125c4f7e53
--- /dev/null
+++ b/auditbeat/module/audit/file/security_windows.go
@@ -0,0 +1,56 @@
+package file
+
+type SecurityDescriptor struct{}
+
+type ACL struct {
+	AclRevision uint8
+	Sbz1        uint8
+	AclSize     uint16
+	AceCount    uint16
+	Sbz2        uint16
+}
+
+// Types of Windows objects that support security.
+type ObjectType uint32
+
+const (
+	UnknownObjectType ObjectType = iota
+	FileObject
+	Service
+	Printer
+	RegistryKey
+	LMShare
+	KernelObject
+	WindowObject
+	DSObject
+	DSObjectAll
+	ProviderDefinedObject
+	WmiGuidObject
+	RegistryWow64_32Key
+)
+
+type SecurityInformation uint32
+
+const (
+	OwnerSecurityInformation             SecurityInformation = 0x00000001
+	GroupSecurityInformation             SecurityInformation = 0x00000002
+	DaclSecurityInformation              SecurityInformation = 0x00000004
+	SaclSecurityInformation              SecurityInformation = 0x00000008
+	LabelSecurityInformation             SecurityInformation = 0x00000010
+	AttributeSecurityInformation         SecurityInformation = 0x00000020
+	ScopeSecurityInformation             SecurityInformation = 0x00000040
+	ProcessTrustLabelSecurityInformation SecurityInformation = 0x00000080
+	BackupSecurityInformation            SecurityInformation = 0x00010000
+	ProtectedDaclSecurityInformation     SecurityInformation = 0x80000000
+	ProtectedSaclSecurityInformation     SecurityInformation = 0x40000000
+	UnprotectedDaclSecurityInformation   SecurityInformation = 0x20000000
+	UnprotectedSaclSecurityInformation   SecurityInformation = 0x10000000
+)
+
+// Use "GOOS=windows go generate -v -x ." to generate the source.
+
+// Add -trace to enable debug prints around syscalls.
+//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsecurity_windows.go security_windows.go
+
+// Windows API calls
+//sys GetSecurityInfo(handle syscall.Handle, objectType ObjectType, securityInformation SecurityInformation, ppsidOwner **syscall.SID, ppsidGroup **syscall.SID, ppDacl **ACL, ppSacl **ACL, ppSecurityDescriptor **SecurityDescriptor) (err error) [failretval!=0] = advapi32.GetSecurityInfo
diff --git a/auditbeat/module/audit/file/security_windows_test.go b/auditbeat/module/audit/file/security_windows_test.go
new file mode 100644
index 000000000000..3384a2447f3f
--- /dev/null
+++ b/auditbeat/module/audit/file/security_windows_test.go
@@ -0,0 +1,40 @@
+package file
+
+import (
+	"io/ioutil"
+	"os"
+	"syscall"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetSecurityInfo(t *testing.T) {
+	// Create a temp file that we will use in checking the owner.
+	file, err := ioutil.TempFile("", "go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(file.Name())
+	defer file.Close()
+
+	// Get the file owner.
+	var securityID *syscall.SID
+	var securityDescriptor *SecurityDescriptor
+	if err := GetSecurityInfo(syscall.Handle(file.Fd()), FileObject,
+		OwnerSecurityInformation, &securityID, nil, nil, nil, &securityDescriptor); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = securityID.String()
+	assert.NoError(t, err)
+	_, _, _, err = securityID.LookupAccount("")
+	assert.NoError(t, err)
+
+	// Freeing the security descriptor releases the memory used by the SID.
+	_, err = syscall.LocalFree((syscall.Handle)(unsafe.Pointer(securityDescriptor)))
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/auditbeat/module/audit/file/zsecurity_windows.go b/auditbeat/module/audit/file/zsecurity_windows.go
new file mode 100644
index 000000000000..162378b424b0
--- /dev/null
+++ b/auditbeat/module/audit/file/zsecurity_windows.go
@@ -0,0 +1,30 @@
+// MACHINE GENERATED BY 'go generate' COMMAND; DO NOT EDIT
+
+package file
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+var (
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+
+	procGetSecurityInfo = modadvapi32.NewProc("GetSecurityInfo")
+)
+
+func GetSecurityInfo(handle syscall.Handle, objectType ObjectType, securityInformation SecurityInformation, ppsidOwner **syscall.SID, ppsidGroup **syscall.SID, ppDacl **ACL, ppSacl **ACL, ppSecurityDescriptor **SecurityDescriptor) (err error) {
+	r1, _, e1 := syscall.Syscall9(procGetSecurityInfo.Addr(), 8, uintptr(handle), uintptr(objectType), uintptr(securityInformation), uintptr(unsafe.Pointer(ppsidOwner)), uintptr(unsafe.Pointer(ppsidGroup)), uintptr(unsafe.Pointer(ppDacl)), uintptr(unsafe.Pointer(ppSacl)), uintptr(unsafe.Pointer(ppSecurityDescriptor)), 0)
+	if r1 != 0 {
+		if e1 != 0 {
+			err = error(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}