# Filebeat auth.oauth2 error appeared on Google workspace config

**URL:** <https://discuss.elastic.co/t/filebeat-auth-oauth2-error-appeared-on-google-workspace-config/344421>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 4, 2023, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-auth-oauth2-error-appeared-on-google-workspace-config/344421 "2023-10-04T18:25:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Umor](https://avatars.discourse-cdn.com/v4/letter/u/edb3f5/32.png) [@Umor](https://discuss.elastic.co/u/Umor)\
**Post date:** [October 4, 2023, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-auth-oauth2-error-appeared-on-google-workspace-config/344421/1 "2023-10-04T18:25:50Z")

</div>

Greetings,

I am using the Google Workspace module, and while running Filebeat the Google logs show and after a couple of minutes this error appeared

`{"log.level":"error","@timestamp":"2023-10-04T23:21:34.745+0500","log.logger":"reload","log.origin":{"file.name":"cfgfile/list.go","file.line":138},"message":"Error creating runner from config: failed to create input: the file \"<no value>\" cannot be found accessing 'auth.oauth2'","service.name":"filebeat","ecs.version":"1.6.0"`

here is my filebeat.yml file

```auto
filebeat.inputs:
- type: httpjson
  enabled: true
  interval: 1m
  request.url: https://www.googleapis.com/auth/admin.reports.audit.readonly

# ============================== Filebeat modules ==============================

  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

filebeat.modules:
- module: google_workspace
# saml:
# enabled: true
# var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
# var.delegated_account: "XXX.com"
  user_accounts:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"
  login:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"
  admin:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"
  drive:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX@podimetrics.com"
  groups:
    enabled: true
    var.jwt_file: "/etc/filebeat/g-workspace-siem-auditiing-pod.json"
    var.delegated_account: "XXX.com"

```

OS: Ubuntu 18.04.6 LTS  
Please let me know what am I missing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2023, 8:25pm UTC](https://discuss.elastic.co/t/filebeat-auth-oauth2-error-appeared-on-google-workspace-config/344421/2 "2023-11-01T20:25:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.