Filebeat O365 Module, API proxy support

Elastic Stack Beats
1

Is there a way to tell Filebeat to use a proxy when attempting to connect to the Microsoft API when pulling down O365 Audit logs?

Here are some errors.

Jul 23 14:45:57 <redacted> filebeat[22797]: 2020-07-23T14:45:57.121-0400        ERROR        fileset/factory.go:103        Error creating input: o365audit: unable to acquire authentication token for tenant:<redacted>: refreshing spt token: adal: Failed to execute the refresh request. Error = 'Post https://login.microsoftonline.com/<redacted>/oauth2/token?api-version=1.0: dial tcp 40.126.0.73:443: i/o timeout'
Jul 23 14:45:57 <redacted> filebeat[22797]: 2020-07-23T14:45:57.121-0400        ERROR        [reload]        cfgfile/list.go:96        Error creating runner from config: o365audit: unable to acquire authentication token for tenant:<redacted>: refreshing spt token: adal: Failed to execute the refresh request. Error = 'Post https://login.microsoftonline.com/<redacted>/oauth2/token?api-version=1.0: dial tcp 40.126.0.73:443: i/o timeout'
2

@robertnixon

I don't believe the Filebeat O365 module supports proxies as of 7.8. The module settings (here) don't list an option for proxies, and the source code (here) doesn't show the use of proxies.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.