Filebeat: Error with the google_workspace module

Elastic Stack Beats
1

Hi all,

I find myself integrating the google_workspace module via filebeat (filebeat-7.17.0-linux-x86_64) on an Ubuntu 20.04 LTS. I have followed all the steps in the "Configure the module" reference (Google Workspace module | Filebeat Reference [8.0] | Elastic) but when I try to start the module from filebeat via the command ./filebeat -e I get the following error (same error but sometimes the file it seems to be the 'credentials.json' and others times it seems to be a priori with no reason:

2022-03-04T09:55:13.430-0800	INFO	[monitoring]	log/log.go:193	Uptime: 3.570796779s
2022-03-04T09:55:13.430-0800	INFO	[monitoring]	log/log.go:160	Stopping metrics logging.
2022-03-04T09:55:13.430-0800	INFO	instance/beat.go:498	filebeat stopped.
2022-03-04T09:55:13.430-0800	ERROR	instance/beat.go:1015	Exiting: Failed to start crawler: creating module reloader failed: error checking input configuration: the file "<no value>" cannot be found accessing 'auth.oauth2'
Exiting: Failed to start crawler: creating module reloader failed: error checking input configuration: the file "<no value>" cannot be found accessing 'auth.oauth2'

2022-03-04T09:55:13.430-0800	INFO	[monitoring]	log/log.go:193	Uptime: 3.570796779s
2022-03-04T09:55:13.430-0800	INFO	[monitoring]	log/log.go:160	Stopping metrics logging.
2022-03-04T09:55:13.430-0800	INFO	instance/beat.go:498	filebeat stopped.
2022-03-04T09:55:13.430-0800	ERROR	instance/beat.go:1015	Exiting: Failed to start crawler: creating module reloader failed: error checking input configuration: the file "<./credentials.json>" cannot be found accessing 'auth.oauth2'
Exiting: Failed to start crawler: creating module reloader failed: error checking input configuration: the file "<./credentials.json>" cannot be found accessing 'auth.oauth2'

My google_workspace.yml has the following content (all the rest it's commented):

# Module: google_workspace
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-google_workspace.html

- module: google_workspace
  saml:
    enabled: true
    var.jwt_file: "./credentials.json"
    var.delegated_account: "admin_account@domain"
  # var.initial_interval: 24h
  # var.http_client_timeout: 60s
  # var.user_key: all
  # var.interval: 2h
  ...

I have tried both with the JSON configuration file of the service account credentials and the OAuth 2.0 Client IDs without success. Anyone who has been able to implement it without problem or has had a similar problem? Looking for information about the error 'auth.oauth2' I find almost no information...

Thanks

2

Hi @PJ_ceSofnI_tseT!

The error seems to come from this file and suggests filebeat is not able to read the credentials file.

To double check:

  • is the credentials file in the same folder you are running the filebeat binary?
  • is the file readable by the user running filebeat?
3

Hi @Edoardo_Tenani !

Yes, the credentials.json file has permissions 766 (in fact, more than it required).
In the tests I did, the file was found in the path: /tmp/beats/filebeat-7.17.0-linux-x86_64/modules.d

I just tried it by copying this file to the filebeat path: /tmp/beats/filebeat-7.17.0-linux-x86_64/ from where I run the command: $/tmp/beats/filebeat-7.17.0-linux-x86_64$ sudo ./filebeat -e and I have the same error outputs.

A strange behavior that I have observed is that sometimes (as it appears in the original post), the file seems to be and other times it does seem to refer to the file specified in the google_workspace.yml, maybe something related with that?

Thanks a lot for your time!

4

Update:

I carried out the tests deactivating the rest of the modules and only with google_workspace enabled (in case there could be a collision) and neither...
I tried running the command filebeat -e -d "*" but got the same details...
I tried to copy credentials.json file to both directories: filebeat and modules.d and same error...

5

May you try using an absolute path to the credentials.json file instead of a relative one?

6

Hi @Edoardo_Tenani !

Yes I tried with the same result!
Maybe a detail it's that if I use the path ./credentials.json sometimes in the error appear credentials.json instead of <none> but when I tried to use the absolute path I never saw the path, only <none>...

7

It seems that downloading the latest version of filebeat 8.1.0, and initializing it from scratch with the same settings, seems to work correctly...

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.