Filebeat Input for salesforce

Elastic Stack Beats
1

Hello,

I'm trying to configure multiple salesforce objects using filebeat inputs and below is the example config. When I verified the logs I can see the query running but I can't see the data. Any help with how to configure multiple modules in salesforce is much appreciated.

Config:

  • type: salesforce
    id: my-generic-id
    fields:
    environment: 'generic-sit'
    enabled: true
    version: 56
    auth.oauth2:
    user_password_flow:
    enabled: true
    client.id: ################
    client.secret: ##########
    token_url: ###########.salesforce.com
    username: #############
    password: ###################
    jwt_bearer_flow:
    enabled: false
    client.id: client-id
    client.username: salesforce-instance@user.in
    client.key_path: server_client.key
    url: https://login.salesforce.com
    url: #############.salesforce.com
    event_monitoring_method:
    event_log_file:
    enabled: false
    interval: 1h
    query:
    default: "SELECT Id,CreatedDate,LogDate,LogFile FROM EventLogFile WHERE EventType = 'Login' ORDER BY CreatedDate ASC NULLS FIRST"
    value: "SELECT Id,CreatedDate,LogDate,LogFile FROM EventLogFile WHERE EventType = 'Login' AND CreatedDate > [[ .cursor.event_log_file.last_event_time ]] ORDER BY CreatedDate ASC NULLS FIRST"
    cursor:
    field: "CreatedDate"
    object:
    enabled: true
    interval: 5m
    query:
    default: "SELECT Id,Integration_Utility__c,Holistic_Application__c,Work_Hours__c,Severity__c,Session_Identifier__c,Name,Class_Method__c,Class_Name__c,Component_Method__c,Component_Name__c,Error_Log_Time__c,Error_Message__c,Device__c,Browser__c,Integration_Log_Type__c,Document_Detail__c,End_Point_URL__c,Integration_Name__c,Integration_Type__c,Additional_Error_Information__c,Requested_On__c,Request_Id__c,Stack_Trace__c,User_Info__c,User_Profile__c,CreatedDate,CreatedById,HTTP_Status_Code__c,Record_Id__c,RequestJSON__c,Responded_On__c,ResponseJSON__c,FederationId__c,LastModifiedDate,LastModifiedById FROM Generic_Log__c"
    value: "SELECT Id,Integration_Utility__c,Holistic_Application__c,Work_Hours__c,Severity__c,Session_Identifier__c,Name,Class_Method__c,Class_Name__c,Component_Method__c,Component_Name__c,Error_Log_Time__c,Error_Message__c,Device__c,Browser__c,Integration_Log_Type__c,Document_Detail__c,End_Point_URL__c,Integration_Name__c,Integration_Type__c,Additional_Error_Information__c,Requested_On__c,Request_Id__c,Stack_Trace__c,User_Info__c,User_Profile__c,CreatedDate,CreatedById,HTTP_Status_Code__c,Record_Id__c,RequestJSON__c,Responded_On__c,ResponseJSON__c,FederationId__c,LastModifiedDate,LastModifiedById FROM Generic_Log__c WHERE CreatedDate > [[ .cursor.object.first_event_time ]]"
    cursor:
    field: "CreatedDate"
  • type: salesforce
    id: my-login-id
    fields:
    test: 'api-sit'
    enabled: true
    version: 56
    auth.oauth2:
    user_password_flow:
    enabled: true
    client.id: ##########
    client.secret: ################
    token_url: #############.salesforce.com
    username: ##################
    password: #################
    jwt_bearer_flow:
    enabled: false
    client.id: client-id
    client.username: salesforce-instance@user.in
    client.key_path: server_client.key
    url: https://login.salesforce.com
    url: ###############.salesforce.com
    event_monitoring_method:
    event_log_file:
    enabled: false
    interval: 1h
    object:
    enabled: true
    interval: 1h
    query:
    default: "SELECT FIELDS(STANDARD) FROM LoginEvent"
    value: "SELECT FIELDS(STANDARD) FROM LoginEvent WHERE EventDate > [[ .cursor.object.first_event_time ]]"
    cursor:
    field: "EventDate"

Thanks,
KK