Is possible to use Filebeat o365 plugin on "offline" data

Elastic Stack Beats
1

Hello community!

I have recently discovered o365 module for Filebeat (Office 365 module | Filebeat Reference [8.7] | Elastic).
My question is: is it possible to use it for offline data?
I'm interested to have it since it's parse data in ECS and also I would love to use its dashboard.
Offline data for me means - export UAL logs from https://compliance.microsoft.com/ in CSV and use Filebeat to grab it and import to Elastic stack. I'm not interested in monitoring live data rather I want to work on data I actually need.

Thanks in advance!

2

If you will manually transfer logs from your location to FB like a dedicated directory, then FB will process in the service mode or only run FB when you copy logs.
Since you have logs in CSV format, you can directly do it in Kibana.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.