diff --git a/auditbeat/module/auditd/audit.go b/auditbeat/module/auditd/audit.go
new file mode 100644
index 00000000000..9812f2fbefe
--- /dev/null
+++ b/auditbeat/module/auditd/audit.go
@@ -0,0 +1,23 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package auditd
+
+const (
+	moduleName    = "auditd"
+	metricsetName = "auditd"
+)
diff --git a/auditbeat/module/auditd/config.go b/auditbeat/module/auditd/config_linux.go
similarity index 98%
rename from auditbeat/module/auditd/config.go
rename to auditbeat/module/auditd/config_linux.go
index 149af7a08a0..d0d90e86c44 100644
--- a/auditbeat/module/auditd/config.go
+++ b/auditbeat/module/auditd/config_linux.go
@@ -35,12 +35,6 @@ import (
 	"github.com/elastic/go-libaudit/v2/rule/flags"
 )
 
-const (
-	moduleName         = "auditd"
-	metricsetName      = "auditd"
-	recursiveGlobDepth = 8
-)
-
 // Config defines the kernel metricset's possible configuration options.
 type Config struct {
 	ResolveIDs   bool     `config:"resolve_ids"`         // Resolve UID/GIDs to names.