# 401 error when setting up filebeat google\_workspace integration

**URL:** <https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 14, 2023, 1:13pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417 "2023-07-14T13:13:15Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [July 14, 2023, 1:13pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/1 "2023-07-14T13:13:15Z")

</div>

Hi All,

I'm using filebeat (7.17.9) and trying to setup google workspace integration.

I've followed all the steps in:

> **[Google Workspace module | Filebeat Reference \[7.17\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-google_workspace.html)**

I've got a json credential file:

```auto
{
  "type": "service_account",
  "project_id": "gwm-1688565370135",
  "private_key_id": "xxx",
  "private_key": "xxx",
  "client_email": "gwm-service-account@gwm-xxx.iam.gserviceaccount.com",
  "client_id": "xxx",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/gwm-service-account%40gwm-1688565370135.iam.gserviceaccount.com",
  "universe_domain": "googleapis.com"
}

```

This is the config file:

```auto
# Module: google_workspace
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-google_workspace.html

- module: google_workspace
  saml:
    enabled: true
    var.jwt_file: "/etc/filebeat/customer_json/xxx_googlews_auth.json"
    var.delegated_account: "gwm-service-account@gwm-xxx.iam.gserviceaccount.com"
    # var.jwt_file: credentials.json
    # var.delegated_account: admin@example.com
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h

```

This is the error i'm getting:

```auto
2023-07-14T13:37:53.483+0100 ERROR [input.httpjson-cursor] v2/input.go:115 Error while processing http request: failed to execute http client.Do: server responded with$
  "error": {
    "code": 401,
    "message": "Access denied. You are not authorized to read activity records.",
    "errors": [
      {
        "message": "Access denied. You are not authorized to read activity records.",
        "domain": "global",
        "reason": "authError",
        "location": "Authorization",
        "locationType": "header"
      }
    ]
  }
}
        {"id": "97E5B91E284F6ECB", "input_source": "https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/admin", "input_url": "https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/admin"}

```

I've checked the client id, the service account name, the domain wide delegation and it is all as it should be.

Anyone else seen this issue?

Thanks  
John

---

<div class="post-metadata">

**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\
**Post date:** [July 18, 2023, 1:00pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/2 "2023-07-18T13:00:49Z")

</div>

Hi @Nightingale_John,

Firstly, I'd recommend that you use our Workspace integration via Elastic Agent, as it's typically easier to configure and also includes several bug fixes and enhancements (broader event coverage and new dashboards) when compared to the Filebeat module.

With regards to the 401 error, it's often due to an issue with the domain wide delegation or a step missed when setting up the service account. Given all the steps required to set up the account on the Workspace side, it's easy to miss something. [This blog post](https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two) walks through the whole process step-by-step. I'd suggest going through it to ensure everything has been set up correctly, and if not, let me know and we can dig deeper.

---

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [July 18, 2023, 2:20pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/3 "2023-07-18T14:20:42Z")

</div>

Thanks Jamie,

Yes, I suspect something to do with the delegation too, but having gone through everything a number of times I'm stumped as to what is misconfigured.

I'll run through the blog post as you mentioned, thank you for that.

At the minute I'm using filebeat for legacy purposes, but intend to review Elastic Agent this week.

Thanks for the help, I'll respond here once I know more.

Best  
John

---

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [July 19, 2023, 2:11pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/4 "2023-07-19T14:11:38Z")

</div>

Hi Jamie,

I went through the blog post and followed as directed, I created a new project to test this out, and it comes out with the same result!

I'm currently using filebeat still, but intend to try it with elastic-agent this week.

Best  
John

---

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [July 20, 2023, 11:05am UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/5 "2023-07-20T11:05:43Z")

</div>

Hello! Progress... I got it working..

The delegated account needed to be set to the admin account that created the service account, rather than the service account that was created... is that expected?!

Best

---

<div class="post-metadata">

**Author:** ![YieldingField](https://avatars.discourse-cdn.com/v4/letter/y/9de0a6/32.png) [@YieldingField](https://discuss.elastic.co/u/YieldingField)\
**Post date:** [July 24, 2023, 7:23am UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/6 "2023-07-24T07:23:36Z")

</div>

Hey @Nightingale_John,

I came here looking for an answer as I'm having the same issue.

When you mention "The delegated account needed to be set to the admin account that created the service account" - is that the Google Workspace domain-wide delegation only? I can't find a client ID for my admin account so a bit lost. Does the Filebeat module still utilize the same Service Account json credential file or is that needed to be regenerated as well?

---

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [July 25, 2023, 3:09pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/7 "2023-07-25T15:09:45Z")

</div>

Hey!

So...

modules.d/google\_workspace.yml

```auto
- module: google_workspace
  saml:
    enabled: true
    var.jwt_file: /path/to/credentials.json
    var.delegated_account: <adminaccount email address, e.g. ja-admin@domainname>

```

the service account email address is in the credentials.json file.

I didn't need to regenerate anything fortunately, I just needed to put the admin account email address of my admin account that I used to create the service account and the resulting JSON file.

Hopefully that makes sense.. but the var.delegated\_account IS NOT the service account email address.

John

---

<div class="post-metadata">

**Author:** ![YieldingField](https://avatars.discourse-cdn.com/v4/letter/y/9de0a6/32.png) [@YieldingField](https://discuss.elastic.co/u/YieldingField)\
**Post date:** [July 25, 2023, 10:12pm UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/8 "2023-07-25T22:12:52Z")

</div>

Got it! That is so.....not intuitive. Working after that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2023, 12:13am UTC](https://discuss.elastic.co/t/401-error-when-setting-up-filebeat-google-workspace-integration/338417/9 "2023-08-23T00:13:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.