# Gsuite module in Filebeat not generating logs

**URL:** <https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 4, 2020, 2:33pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288 "2020-11-04T14:33:41Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 4, 2020, 2:33pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/1 "2020-11-04T14:33:42Z")

</div>

Gsuite module in Filebeat not pushing the logs to Elasticsearch. I have configured the service account and domain wide delegation and setup the proper scope required. Still it throws back a error code 401 which says cannot process the request.

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [November 4, 2020, 3:23pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/2 "2020-11-04T15:23:03Z")

</div>

Can you post the configuration files and some logs?

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 4, 2020, 3:57pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/3 "2020-11-04T15:57:09Z")

</div>

```auto
    - module: gsuite
  saml:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxxxx@xxxx.gserviceaccount.com"

user_accounts:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxxxx@xxxx.gserviceaccount.com"
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
  login:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: ""xxxxx@xxxx.gserviceaccount.com"

```

This is the gsuite.yml file in /etc/filebeat/modules.d.

Logs :

Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.113Z INFO [httpjson] httpjson/input.go:130 Initialized httpjson input. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.116Z INFO [httpjson] httpjson/input.go:130 Initialized httpjson input. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.118Z INFO [httpjson] httpjson/input.go:130 Initialized httpjson input. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user\_accounts](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.143Z INFO [httpjson] httpjson/input.go:140 httpjson input worker has started. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.150Z INFO [httpjson] httpjson/input.go:140 httpjson input worker has started. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.164Z INFO [httpjson] httpjson/input.go:140 httpjson input worker has started. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user\_accounts](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.361Z ERROR [httpjson] httpjson/input.go:145 http request was unsuccessful with a status code 401 {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.362Z INFO [httpjson] httpjson/input.go:146 httpjson input worker has stopped. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/login)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.370Z ERROR [httpjson] httpjson/input.go:145 http request was unsuccessful with a status code 401 {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.371Z INFO [httpjson] httpjson/input.go:146 httpjson input worker has stopped. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.377Z ERROR [httpjson] httpjson/input.go:145 http request was unsuccessful with a status code 401 {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user\_accounts](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts)"}  
Nov 04 12:58:43 ip-10-0-0-143 filebeat[4731]: 2020-11-04T12:58:43.378Z INFO [httpjson] httpjson/input.go:146 httpjson input worker has stopped. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user\_accounts](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts)"}  
Nov 04 13:41:24 ip-10-0-0-143 filebeat[5740]: 2020-11-04T13:41:24.626Z INFO [httpjson] httpjson/input.go:130 Initialized httpjson input. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml)"}  
Nov 04 13:41:24 ip-10-0-0-143 filebeat[5740]: 2020-11-04T13:41:24.629Z INFO [httpjson] httpjson/input.go:140 httpjson input worker has started. {"url": "[https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml](https://www.googleapis.com/admin/reports/v1/activity/users/all/applications/saml)"}

This is the logs which shows 401 status code. I have confirmed scope is set correctly and other steps as per the documentation for the module.

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [November 4, 2020, 3:59pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/4 "2020-11-04T15:59:07Z")

</div>

> [@Edwin.v](#):
>
> `var.delegated_account: ""xxxxx@xxxx.gserviceaccount.com"`

Is that correct? Double quotes `""` at the beginning of the email?

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 4, 2020, 4:01pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/5 "2020-11-04T16:01:08Z")

</div>

This I put the service account email which was created and provide access to scope. I did not want to reveal it.

And Yes there are double quotes . Is that an issue ?

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [November 4, 2020, 5:34pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/6 "2020-11-04T17:34:56Z")

</div>

I mean that you write double quotes **twice** at the beginning of the email

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 4, 2020, 6:22pm UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/7 "2020-11-04T18:22:42Z")

</div>

No. That was accidental. In my real code I didn't do it. Thank you for pointing it out. I wanted to know if there was any way I could manually check my access to Admin API is set correctly using command line. Error 401 shows invalid request.

---

<div class="post-metadata">

**Author:** ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)\
**Post date:** [November 5, 2020, 8:50am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/8 "2020-11-05T08:50:58Z")

</div>

Hello @Edwin.v! Is the delegated account an admin account?

In 7.9 docs this was not specified clearly, which is fixed in 7.10 ones already [https://www.elastic.co/guide/en/beats/filebeat/7.10/filebeat-module-gsuite.html](https://www.elastic.co/guide/en/beats/filebeat/7.10/filebeat-module-gsuite.html)

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 5, 2020, 9:07am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/9 "2020-11-05T09:07:26Z")

</div>

No. I am using the service account. I tried my admin account instead and it's working. I see the logs coming now. I was about to post this.

Only thing I am concerned now about is getting a dashboard access. As I don't have any specific option for this. And I am having some difficulty creating an alert for the login alerts

---

<div class="post-metadata">

**Author:** ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)\
**Post date:** [November 5, 2020, 10:35am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/10 "2020-11-05T10:35:56Z")

</div>

> [@Edwin.v](#):
>
> No. I am using the service account. I tried my admin account instead and it's working. I see the logs coming now. I was about to post this.

Awesome!

> [@Edwin.v](#):
>
> Only thing I am concerned now about is getting a dashboard access. As I don't have any specific option for this. And I am having some difficulty creating an alert for the login alerts

I am afraid right now there is no default dashboard provided for Gsuite module, but I opened an issue to keep track of this [[Filebeat][Gsuite] Create default dashboard · Issue #22441 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/22441)

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 5, 2020, 10:48am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/11 "2020-11-05T10:48:03Z")

</div>

Great. Thanks

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 6, 2020, 5:19am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/12 "2020-11-06T05:19:26Z")

</div>

@marc.guasch. Inside the gsuite module : saml, user\_accounts, login works fine without any issues. But when I enable admin or drive or groups. I am getting the following error.

2020-11-06T04:42:56.962Z#011ERROR#011cfgfile/reload.go:273#011Error loading config from file '/etc/filebeat/modules.d/gsuite.yml', error invalid config: yaml: line 38: did not find expected key.

I tried every option individually still the same issue. Any idea what the issue can be ?

---

<div class="post-metadata">

**Author:** ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)\
**Post date:** [November 6, 2020, 7:36am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/13 "2020-11-06T07:36:20Z")

</div>

Can you paste the config to see what can be the issue?

---

<div class="post-metadata">

**Author:** ![Edwin.v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edwin.v/32/77872_2.png) [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\
**Post date:** [November 6, 2020, 7:55am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/14 "2020-11-06T07:55:01Z")

</div>

Yes. This is the config:

```auto
# Module: gsuite
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-gsuite.html

- module: gsuite
  saml:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxx@g.com"
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
  user_accounts:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxx@g.com"
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
  login:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxx@g.com"
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
  admin:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxx@g.com"
    # var.initial_interval: 4h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
  drive:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxx@g.com"
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
  groups:
    enabled: true
    var.jwt_file: "/etc/filebeat/credentials.json"
    var.delegated_account: "xxx@g.com"
    # var.initial_interval: 24h
    # var.http_client_timeout: 60s
    # var.user_key: all
    # var.interval: 2h
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2020, 9:55am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288/15 "2020-12-04T09:55:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.