Filebeat configuration (o365 module) is not working


Im trying to configure the 0365 module with this:

# List of content-types to fetch. By default all known content-types # are retrieved:
var.content_type: - "Audit.AzureActiveDirectory"
# - "Audit.Exchange" # - "Audit.SharePoint"
# - "Audit.General" # - "DLP.All"

But it is not working. Can someone help me out? It seems like something so simple.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.