# Google Workspace Filebeat SAML issue **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 10, 2021, 6:53pm UTC](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859 "2021-03-10T18:53:31Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Hanse00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanse00/32/85338_2.png) [@Hanse00](https://discuss.elastic.co/u/Hanse00)\ **Post date:** [March 10, 2021, 6:53pm UTC](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859/1 "2021-03-10T18:53:31Z")
Hi everyone, I believe I've discovered a bug in the Google Workspace module for Filebeat. Posting here first per the instructions on GitHub. When using the Google Workspace module, all sub-modules but SAML logging (Admin, User Accounts, Login, Drive, and Groups) work fine, both independently and all at once. However as soon as I enable the SAML logging functionality, an error is thrown by the module after retrieving and processing the data from the Google API. Version: filebeat version 7.11.2 (amd64), libbeat 7.11.2 [1d9cced55410003f5d0b4594ff5471d15a4e2900 built 2021-03-06 05:39:42 +0000 UTC] OS: macOS 10.15.7 Command run: filebeat -e -d '\*' Error output: ```auto 2021-03-10T09:51:54.167-0800 DEBUG [esclientleg] eslegclient/connection.go:364 GET https://[REDACTED]/_ingest/pipeline/filebeat-7.11.2-google_workspace-saml-common 2021-03-10T09:51:54.192-0800 DEBUG [modules] fileset/pipelines.go:120 Pipeline filebeat-7.11.2-google_workspace-saml-common already loaded 2021-03-10T09:51:54.192-0800 INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(elasticsearch(https://[REDACTED])) established 2021-03-10T09:51:54.192-0800 DEBUG [esclientleg] eslegclient/bulkapi.go:230 Failed to encode message: unsupported float value: NaN 2021-03-10T09:51:54.192-0800 ERROR [elasticsearch] elasticsearch/client.go:224 failed to perform any bulk index operations: unsupported float value: NaN 2021-03-10T09:51:54.192-0800 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer 2021-03-10T09:51:54.192-0800 INFO [publisher] pipeline/retry.go:223 done 2021-03-10T09:51:55.966-0800 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: unsupported float value: NaN 2021-03-10T09:51:55.966-0800 INFO [publisher_pipeline_output] pipeline/output.go:143 Connecting to backoff(elasticsearch(https://[REDACTED])) 2021-03-10T09:51:55.966-0800 DEBUG [esclientleg] eslegclient/connection.go:290 ES Ping(url=https://[REDACTED]) 2021-03-10T09:51:55.966-0800 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer 2021-03-10T09:51:55.966-0800 INFO [publisher] pipeline/retry.go:223 done 2021-03-10T09:51:55.982-0800 DEBUG [esclientleg] eslegclient/connection.go:313 Ping status code: 200 2021-03-10T09:51:55.982-0800 INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.10.1 2021-03-10T09:51:55.982-0800 DEBUG [esclientleg] eslegclient/connection.go:364 GET https://[REDACTED]/_license?human=false 2021-03-10T09:51:56.016-0800 DEBUG [license] licenser/check.go:31 Checking that license covers %sBasic 2021-03-10T09:51:56.016-0800 INFO [license] licenser/es_callback.go:51 Elasticsearch license: Platinum 2021-03-10T09:51:56.016-0800 DEBUG [esclientleg] eslegclient/connection.go:364 GET https://[REDACTED]/ 2021-03-10T09:51:56.038-0800 DEBUG [modules] fileset/pipelines.go:67 Required processors: [{geoip ingest-geoip}] 2021-03-10T09:51:56.038-0800 DEBUG [esclientleg] eslegclient/connection.go:364 GET https://[REDACTED]/_nodes/ingest 2021-03-10T09:51:56.067-0800 DEBUG [esclientleg] eslegclient/connection.go:364 GET https://[REDACTED]/_ingest/pipeline/filebeat-7.11.2-google_workspace-saml-common 2021-03-10T09:51:56.091-0800 DEBUG [modules] fileset/pipelines.go:120 Pipeline filebeat-7.11.2-google_workspace-saml-common already loaded 2021-03-10T09:51:56.091-0800 INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(elasticsearch(https://[REDACTED])) established 2021-03-10T09:51:56.091-0800 DEBUG [esclientleg] eslegclient/bulkapi.go:230 Failed to encode message: unsupported float value: NaN 2021-03-10T09:51:56.091-0800 ERROR [elasticsearch] elasticsearch/client.go:224 failed to perform any bulk index operations: unsupported float value: NaN 2021-03-10T09:51:56.091-0800 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer 2021-03-10T09:51:56.091-0800 INFO [publisher] pipeline/retry.go:223 done ``` Any thoughts or suggestions would be greatly appreciated 🙂 ---
**Author:** ![Felipe\_Fuller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felipe_fuller/32/80377_2.png) [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Post date:** [March 26, 2021, 6:22pm UTC](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859/2 "2021-03-26T18:22:31Z")
Hi @Hanse00 , were you able to solve this? I'm having the same issue ☹ ---
**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\ **Post date:** [March 29, 2021, 9:40am UTC](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859/3 "2021-03-29T09:40:33Z")
Thank you both for flagging this issue. @marc.guasch has a PR in progress to address the bug: [[Filebeat[Fix saml status code parsing for google workspace by marc-gr · Pull Request #24785 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/24785) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 26, 2021, 11:41am UTC](https://discuss.elastic.co/t/google-workspace-filebeat-saml-issue/266859/4 "2021-04-26T11:41:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.