# Elasticsearch fleet error

**URL:** <https://discuss.elastic.co/t/elasticsearch-fleet-error/312117>\
**Category:** Elasticsearch\
**Tags:** fleet, elastic-agent\
**Created:** [August 15, 2022, 6:09pm UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117 "2022-08-15T18:09:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\
**Post date:** [August 15, 2022, 6:09pm UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117/1 "2022-08-15T18:09:48Z")

</div>

Good evening, I use elastic 7.17.5 and fleet 7.17, on Sunday after 18:00 notifications to Microsoft 365 integration stopped coming, or rather they do, but a strictly fixed amount in a period of time, the error is as follows:

```auto
error.message
field [o365audit] not present as part of path [o365audit.CreationTime]

```

I updated the integration to the latest version, can anyone tell me what can be done here?

---

<div class="post-metadata">

**Author:** ![llamskt](https://avatars.discourse-cdn.com/v4/letter/l/b5e925/32.png) [@llamskt](https://discuss.elastic.co/u/llamskt)\
**Post date:** [August 18, 2022, 9:20pm UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117/2 "2022-08-18T21:20:22Z")

</div>

Having the same issue. Elastic version 8.3 but recently updated the Microsoft 365 integration to version 1.7.1. The integration appears to work on a version that was configured on a previous version of the integration and the upgraded, but a newly configured Microsoft 365 integration produces this same error me.

---

<div class="post-metadata">

**Author:** ![neil6323](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neil6323/32/92234_2.png) [@neil6323](https://discuss.elastic.co/u/neil6323)\
**Post date:** [August 24, 2022, 5:34am UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117/3 "2022-08-24T05:34:53Z")

</div>

Hi all. I have the same issue. Elastic version 8.3.2 and Microsoft 365 integration version 1.7.1. I have tried a new integration on a different host and I get the same problem. I get the same error message as @alex_96.

---

<div class="post-metadata">

**Author:** ![neil6323](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neil6323/32/92234_2.png) [@neil6323](https://discuss.elastic.co/u/neil6323)\
**Post date:** [August 24, 2022, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117/4 "2022-08-24T06:44:36Z")

</div>

An update - I used a legacy filebeat config which I used previously and I got the following error message (partial).

```auto
unable to acquire authentication token for tenant:XXXX: refreshing spt token: XXXX: Refresh request failed. Status Code = '401'. Response body:{"error":"invalid_client","error_description":"XXXX: The provided client secret keys for app 'XXXX' are expired. Visit the Azure portal to create new keys for your app

```

I have to speak to another team to get this resolved (they have confirmed it has expired - just need to get new credentials). Will update when and if fixed.

---

<div class="post-metadata">

**Author:** ![neil6323](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neil6323/32/92234_2.png) [@neil6323](https://discuss.elastic.co/u/neil6323)\
**Post date:** [August 24, 2022, 11:23pm UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117/5 "2022-08-24T23:23:29Z")

</div>

To confirm from my side, the issue was expired credentials. And renewing these and changing the appropriate field in the integration config resolved the issue. As an aside, there may be a way to do this with Elastic Agent and integrations but using a Filebeat and the O365 module with the relevant config, gave me a more specific error with detail needed to narrow this down.

Now if I can find a way to get an alert when the credentials are going to expire!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2022, 11:24pm UTC](https://discuss.elastic.co/t/elasticsearch-fleet-error/312117/6 "2022-09-21T23:24:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.