Filebeat auth.oauth2 error appeared on Google workspace config

Elastic Stack Beats
1

Greetings,

I am using the Google Workspace module, and while running Filebeat the Google logs show and after a couple of minutes this error appeared

{"log.level":"error","@timestamp":"2023-10-04T23:21:34.745+0500","log.logger":"reload","log.origin":{"file.name":"cfgfile/list.go","file.line":138},"message":"Error creating runner from config: failed to create input: the file \"<no value>\" cannot be found accessing 'auth.oauth2'","service.name":"filebeat","ecs.version":"1.6.0"

here is my filebeat.yml file

filebeat.inputs:
- type: httpjson
  enabled: true
  interval: 1m
  request.url: https://www.googleapis.com/auth/admin.reports.audit.readonly

# ============================== Filebeat modules ==============================

  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

filebeat.modules:
- module: google_workspace
#  saml:
#    enabled: true
#    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
#    var.delegated_account: "XXX.com"
  user_accounts:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"
  login:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"
  admin:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"
  drive:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX@podimetrics.com"
  groups:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"

OS: Ubuntu 18.04.6 LTS
Please let me know what am I missing.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.