diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 8e8ca131ddcc..033384fb7ceb 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -54,6 +54,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 - auditd: Prevent mapping explosion when truncated EXECVE records are ingested. {pull}30382[30382]
 - elasticsearch: fix duplicate ingest when using a common appender configuration {issue}30428[30428] {pull}30440[30440]
 - Fix ECS version string in threatintel to be consistent with other modules and add event.timezone. {issue}30499[30499] {pull}30570[30570]
+- Add default paths value to MySQL Enterprise module to prevent issues with pipeline installations {pull}30598[30598]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml b/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml
index e6341e1da266..b216500d2987 100644
--- a/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml
+++ b/x-pack/filebeat/module/mysqlenterprise/audit/manifest.yml
@@ -1,6 +1,9 @@
 module_version: 1.0
 
 var:
+  - name: paths
+    default:
+      - /home/user/mysqlauditlogs/audit.*.log
   - name: tags
     default: [mysqlenterprise-audit]
   - name: input