# Filebeat O365 Module, API proxy support

**URL:** https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368
**Category:** Beats
**Tags:** filebeat
**Created:** [July 23, 2020, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368 "2020-07-23T16:10:13Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![robertnixon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robertnixon/32/72710_2.png) [@robertnixon](https://discuss.elastic.co/u/robertnixon)
#### Post date: [July 23, 2020, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368/1 "2020-07-23T16:10:13Z")

</div>

Is there a way to tell Filebeat to use a proxy when attempting to connect to the Microsoft API when pulling down O365 Audit logs?

Here are some errors.

```auto
Jul 23 14:45:57 <redacted> filebeat[22797]: 2020-07-23T14:45:57.121-0400 ERROR fileset/factory.go:103 Error creating input: o365audit: unable to acquire authentication token for tenant:<redacted>: refreshing spt token: adal: Failed to execute the refresh request. Error = 'Post https://login.microsoftonline.com/<redacted>/oauth2/token?api-version=1.0: dial tcp 40.126.0.73:443: i/o timeout'
Jul 23 14:45:57 <redacted> filebeat[22797]: 2020-07-23T14:45:57.121-0400 ERROR [reload] cfgfile/list.go:96 Error creating runner from config: o365audit: unable to acquire authentication token for tenant:<redacted>: refreshing spt token: adal: Failed to execute the refresh request. Error = 'Post https://login.microsoftonline.com/<redacted>/oauth2/token?api-version=1.0: dial tcp 40.126.0.73:443: i/o timeout'

```

---

<div class="post-metadata">

### Author: ![davemoore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davemoore/32/134233_2.png) [@davemoore](https://discuss.elastic.co/u/davemoore)
#### Post date: [August 4, 2020, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368/2 "2020-08-04T15:10:49Z")

</div>

@robertnixon

I don't believe the Filebeat O365 module supports proxies as of 7.8. The module settings ([here](https://www.elastic.co/guide/en/beats/filebeat/7.8/filebeat-module-o365.html#o365-settings)) don't list an option for proxies, and the source code ([here](https://github.com/elastic/beats/blob/7.8/x-pack/filebeat/input/o365audit/input.go)) doesn't show the use of proxies.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2020, 5:10pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-api-proxy-support/242368/3 "2020-09-01T17:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.