# Delay in office logs

**URL:** <https://discuss.elastic.co/t/delay-in-office-logs/360513>\
**Category:** Elastic Security\
**Created:** [May 29, 2024, 8:39pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513 "2024-05-29T20:39:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrosendo](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@mrosendo](https://discuss.elastic.co/u/mrosendo)\
**Post date:** [May 29, 2024, 8:39pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513/1 "2024-05-29T20:39:51Z")

</div>

Hi everyone,

We just integrated Office 365 and we followed the steps describen in the integration. The API is showing that requests from Azure are ok, but the logs in Kibana comes like with 7 days of delay, so we don't know if this is a configuration from Azure, did anyone have experienced that? I attached and image with the logs that we are receiving.

 ![office](https://us1.discourse-cdn.com/elastic/original/3X/3/2/320c36eb852b5ca715a367a5b639715d786fb5b0.png)

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 30, 2024, 4:38pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513/2 "2024-05-30T16:38:55Z")

</div>

Hello,

Fyi, we have a little latency, like 15 minutes or so. 7 days seems not right. Is this with the Elastic Agent integration or the FIlebeat module?

WillemD

---

<div class="post-metadata">

**Author:** ![mrosendo](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@mrosendo](https://discuss.elastic.co/u/mrosendo)\
**Post date:** [June 4, 2024, 8:44pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513/3 "2024-06-04T20:44:03Z")

</div>

Yes that's why we are confused, we have another cluster with the same but the logs come in real time. This is with an Elastic Agent, we are using the Microsoft 365 Integration.

So maybe someone has experienced this before, maybe it's not related with Elastic, insted is Microsoft.

---

<div class="post-metadata">

**Author:** ![guessWho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guesswho/32/135240_2.png) [@guessWho](https://discuss.elastic.co/u/guessWho)\
**Post date:** [June 8, 2024, 9:54pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513/4 "2024-06-08T21:54:21Z")

</div>

Barring any issues with your API, this could be the one Microsoft thing that I've seen over the years. Microsoft does not guarantee timely delivery of logs to their API. I've seen logs come in a year late before just because that's when whatever goes on with their backend finally coughed up the logs to the API. I've seen many people think they are going to get Microsoft to fix this by opening tickets with them; has yet to change in the years I've been in security and looking at Microsoft logs every day.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2024, 9:54pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513/5 "2024-07-06T21:54:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.