# FileBeat Gsuite module deprecated? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/filebeat-gsuite-module-deprecated/262939 "2021-02-02T07:50:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ido](https://avatars.discourse-cdn.com/v4/letter/i/e274bd/32.png) [@ido](https://discuss.elastic.co/u/ido)\ **Post date:** [February 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/filebeat-gsuite-module-deprecated/262939/1 "2021-02-02T07:50:44Z")
TL;DR - gsuite module does not send logs although it seems that I've done everything right (more details in the post). I looked at the source code and there was a comment saying "Gsuite module is deprecated... use Google Workspace module instead." does this mean that it is currently broken until google workspace will replace it? I wanted to check the possibility of using the gsuite module, so I installed filebeat, elastic search, kibana and logstash (to save logs in s3). When I ran filebeat over local logs everything worked fine, and logs got save to my configured s3. Then I tried to configure the gsuite module, and although everything seemed fine (filebeat logs showed that all of the 6 inputs from the module were successfully loaded), no logs came out. I did a lot of digging, and then I found the note about gsuite being deprecated in the module code. Does this mean that the module is not currently working? I ran filebeat using "filebeat -e -d "\*" ", and no errors regarding the module were printed. I'm attaching my module config just in case (and the email is the super admin email) > Thanks! ---
**Author:** ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)\ **Post date:** [February 2, 2021, 10:47am UTC](https://discuss.elastic.co/t/filebeat-gsuite-module-deprecated/262939/2 "2021-02-02T10:47:51Z")
Hello! Which filebeat version are you running? I see your config is referencing `google_workspace` module instead of `gsuite`, which is not included in 7.10 which is our latest release. Also, if you could include the output of the logs, that would help us to get a bit more information. In the meantime, you can manually try an API call to see if there are events to report: - Access [OAuth 2.0 Playground](https://developers.google.com/oauthplayground/) - Log in with the account used in `delegated_account` - In step 1 fill in the scope `https://www.googleapis.com/auth/admin.reports.audit.readonly` and hit the authorize button - In step 2 fill the Authorization code with the one obtained from Step 1 - In step 3 fill in the url `https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/admin` and check what the response is to verify data You can add `startTime` parameter set to a date in the last 24h which is the default initial value used by the module. Are you able to get any records back? ---
**Author:** ![ido](https://avatars.discourse-cdn.com/v4/letter/i/e274bd/32.png) [@ido](https://discuss.elastic.co/u/ido)\ **Post date:** [February 2, 2021, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-gsuite-module-deprecated/262939/3 "2021-02-02T14:04:44Z")
Hey, thanks for the reply! I'm using filebeat 7.10.2. I accidentally attached the config I tried in order to make use of google\_workspace (because I've seen it in the repo), but what I described above was relevant to the gsuite module. (when trying to run this with the google\_workspace filebeat ofc doesn't recognise the module) [These are the logs I get when running the gsuite module](https://gist.github.com/ido-hunters/6a041f47a6cf11bf98d5d297c826410f), using this command: filebeat -e -d "\*" --modules gsuite &\> ~/tmp/filebeat\_logs.txt I tried the playground, and it does return me records (a json with a list of items) Also, when I tried to run the module I logged in into google drive and the admin workspace just to be sure there was activity, but nothing was received in filebeat. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2021, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-gsuite-module-deprecated/262939/4 "2021-03-02T16:05:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.