Filebeat Azure Module Base64 Issue

Elastic Stack Beats
,
1

Good Afternoon,

We currently get the error below when running the azure module on Filebeat 8.0.1

@timestamp":"2022-03-31T12:45:12.573Z","log.logger":"azure-eventhub input","log.origin":{"file.name":"azureeventhub/input.go","file.line":113},"message":"illegal base64 data at input byte 84","service.name":"filebeat","connection string":"Endpoint=sb://signin-eventhub.servicebus.windows.net/","ecs.version":"1.6.0"}

Am I right in saying that Filebeat only supports standard Base64 and not URL Safe Base64, thus causing an issue with the - in the endpoint URL?

If this is the case then is it just a case of redoing the Eventhub namespace without the - in the name or is there another solution to this?

2

I have the same issue. So removing the '-' from the event hub name can solve the issue ?

3

Afternoon,

Yes found that this resolved the issue.

Filebeat uses standard Base64 in which the '-' is not a valid character.
Change the Namespace to without the - and it all works.

4

Thanks a lot !

5

I removed the '-' but il still doesn't work. My error is "illegal base64 data at input byte 24"

Any suggestions please ? Thanks

6

Can you supply the Error message you're seeing, should hopefully provide some better insight into the differences between our setups.

7

Yes of course:

{"log.level":"error","@timestamp":"2022-04-05T15:29:13.352Z","log.logger":"azure-eventhub input","log.origin":{"file.name":"azureeventhub/input.go","file.line":113},"message":"illegal base64 data at input byte 24","service.name":"filebeat","connection string":"Endpoint=sb://eventhubdmznonprd.servicebus.windows.net/","ecs.version":"1.6.0"}

8

Any clues ? I don't understand the illegal base64 data at input byte 24. How do I know where the byte 24 is ?

Thanks

9

My issue was due to the storage account key which doesn't accept a SAS string.