# Error setting up connection to Salesforce

**URL:** <https://discuss.elastic.co/t/error-setting-up-connection-to-salesforce/366477>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 12, 2024, 12:58pm UTC](https://discuss.elastic.co/t/error-setting-up-connection-to-salesforce/366477 "2024-09-12T12:58:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dwjvaughan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dwjvaughan/32/10648_2.png) [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\
**Post date:** [September 12, 2024, 12:58pm UTC](https://discuss.elastic.co/t/error-setting-up-connection-to-salesforce/366477/1 "2024-09-12T12:58:39Z")

</div>

I keep hitting the following error when trying to use the Salesforce module in filebeat against our sandbox environment:  
`{"function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1","file.name":"compat/compat.go","file.line":139},"message":"Input 'salesforce' failed with: input login failed: error setting up connection to Salesforce: session response error: 400 400 Bad Request","service.name":"filebeat","id":"login","ecs.version":"1.6.0"}`  
I believe I've set up the Connected App correctly:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d7d75aa55cbe241ea88c6c41a037f671cc11b37.png)

salesforce.yml has the following:

```auto
  login:
    enabled: true
    var.initial_interval: 1d
    var.api_version: 61

    var.authentication:
      user_password_flow:
        enabled: true
        client.id: '${SF_CLIENT_ID}'
        client.secret: '${SF_CLIENT_SECRET}'
        token_url: '${SF_TOKEN_URL}'
        username: '${SF_USERNAME}'
        password: '${SF_PASSWORD}'
      jwt_bearer_flow:
        enabled: false

    var.url: '${SF_URL}'

    var.event_log_file: true
    var.elf_interval: 1h
    var.log_file_interval: 'Hourly'

    var.real_time: true
    var.real_time_interval: 5m

```

I believe the values for the above are correct, with the exception of `var.url` and `var.authentication.user_password_flow.token_url`. It's unclear if these should be `https://test.salesforce.com` of the instance URL (which I assume could either be the "classic" url or the "lightning" one. Hopefully someone has managed to set this up. Full disclosure, I know nothing about SF.

Thanks,  
Dave