diff --git a/salt/filebeat/defaults.yaml b/salt/filebeat/defaults.yaml
index 0103fc82b..2bd96ca13 100644
--- a/salt/filebeat/defaults.yaml
+++ b/salt/filebeat/defaults.yaml
@@ -14,6 +14,7 @@ filebeat:
     - irc
     - kerberos
     - modbus
+    - mysql
     - notice
     - ntlm
     - pe
@@ -25,20 +26,20 @@ filebeat:
     - smb_mapping
     - smtp
     - snmp
+    - socks
     - ssh
     - ssl
     - tunnel
     - weird
-    - mysql
-    - socks
     - x509
-    - dnp3_objects
-    - modbus_detailed
-    - modbus_mask_write_single_register
-    - modbus_read_write_multiple_registers
     - bacnet
     - bacnet_discovery
     - bacnet_property
+    - cip
+    - cip_io
+    - cip_identity
+    - cotp
+    - dnp3_objects
     - ecat_registers
     - ecat_log_address
     - ecat_dev_info
@@ -48,45 +49,78 @@ filebeat:
     - ecat_soe_info
     - ecat_arp_info
     - enip
-    - cip
-    - cip_io
-    - cip_identity
+    - modbus_detailed
+    - modbus_mask_write_single_register
+    - modbus_read_write_multiple_registers
+    - opcua
+    - opcua_activate_session
+    - opcua_activate_session_client_software_cert
+    - opcua_activate_session_diagnostic_info
+    - opcua_activate_session_locale_id
     - opcua_binary
-    - opcua_binary_status_code_detail
-    - opcua_binary_diag_info_detail
-    - opcua_binary_get_endpoints
-    - opcua_binary_get_endpoints_discovery
-    - opcua_binary_get_endpoints_user_token
-    - opcua_binary_get_endpoints_description
-    - opcua_binary_get_endpoints_locale_id
-    - opcua_binary_get_endpoints_profile_uri
-    - opcua_binary_create_session
-    - opcua_binary_create_session_user_token
-    - opcua_binary_create_session_endpoints
-    - opcua_binary_create_session_discovery
     - opcua_binary_activate_session
     - opcua_binary_activate_session_client_software_cert
-    - opcua_binary_activate_session_locale_id
     - opcua_binary_activate_session_diagnostic_info
+    - opcua_binary_activate_session_locale_id
     - opcua_binary_browse
     - opcua_binary_browse_description
-    - opcua_binary_browse_request_continuation_point
-    - opcua_binary_browse_result
-    - opcua_binary_browse_response_references
     - opcua_binary_browse_diagnostic_info
+    - opcua_binary_browse_request_continuation_point
+    - opcua_binary_browse_response_references
+    - opcua_binary_browse_result
+    - opcua_binary_create_session
+    - opcua_binary_create_session_discovery
+    - opcua_binary_create_session_endpoints
+    - opcua_binary_create_session_user_token
     - opcua_binary_create_subscription
+    - opcua_binary_diag_info_detail
+    - opcua_binary_get_endpoints
+    - opcua_binary_get_endpoints_description
+    - opcua_binary_get_endpoints_discovery
+    - opcua_binary_get_endpoints_locale_id
+    - opcua_binary_get_endpoints_profile_uri
+    - opcua_binary_get_endpoints_user_token
+    - opcua_binary_opensecure_channel
     - opcua_binary_read
-    - cotp
+    - opcua_binary_read_array_dims
+    - opcua_binary_read_array_dims_link
+    - opcua_binary_read_diagnostic_info
+    - opcua_binary_read_extension_object
+    - opcua_binary_read_extension_object_link
+    - opcua_binary_read_nodes_to_read
+    - opcua_binary_read_results
+    - opcua_binary_read_results_link
+    - opcua_binary_read_status_code
+    - opcua_binary_read_variant_data
+    - opcua_binary_read_variant_data_link
+    - opcua_binary_status_code_detail
+    - opcua_browse
+    - opcua_browse_description
+    - opcua_browse_response_references
+    - opcua_browse_result
+    - opcua_create_session
+    - opcua_create_session_endpoints
+    - opcua_create_session_user_token
+    - opcua_create_subscription
+    - opcua_get_endpoints
+    - opcua_get_endpoints_description
+    - opcua_get_endpoints_user_token
+    - opcua_opensecure_channel
+    - opcua_read
+    - opcua_read_nodes_to_read
+    - opcua_read_results
+    - opcua_read_results_link
+    - opcua_status_code_detail
+    - profinet_dce_rpc
+    - profinet
+    - profinet_debug
     - s7comm
     - s7comm_read_szl
     - s7comm_upload_download
     - s7comm_plus
+    - stun
+    - stun_nat
     - tds
     - tds_rpc
     - tds_sql_batch
-    - profinet_dce_rpc
-    - profinet
-    - profinet_debug
-    - stun
-    - stun_nat
     - wireguard