# O365 module: No such input type exist: 'o365audit'

**URL:** https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848
**Category:** Beats
**Tags:** filebeat
**Created:** [September 21, 2022, 9:31am UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848 "2022-09-21T09:31:08Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![sriramb12](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriramb12/32/110719_2.png) [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [September 21, 2022, 9:31am UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848/1 "2022-09-21T09:31:08Z")

</div>

The beat is throwing this error:

```auto
Sep 21 14:57:51 xxxx.lan filebeat[17245]: {"log.level":"debug","@timestamp":"2022-09-21T14:57:51.483+0530","log.logger":"processors","log.origin":{"file.name":"processors/processor.go","file.line":121},"message":"Generated new processors: script=[type=javascript, id=, sources=/usr/share/filebeat/module/o365/audit/config/pipeline.js], condition=has_fields: [o365audit], add_fields={\"ecs\":{\"version\":\"1.12.0\"}}","service.name":"filebeat","ecs.version":"1.6.0"}
Sep 21 14:57:51 xxx.lan filebeat[17245]: {"log.level":"error","@timestamp":"2022-09-21T14:57:51.483+0530","log.logger":"reload","log.origin":{"file.name":"cfgfile/list.go","file.line":109},"message":"Error creating runner from config: failed to create input: Error creating input. No such input type exist: 'o365audit'","service.name":"filebeat","ecs.version":"1.6.0"}

```

Any pointers?  
[root@xxx filebeat]# filebeat version  
filebeat version 8.4.2 (amd64), libbeat 8.4.2 [b00a6bca7be493b01a134a6ad8c415f2be297414 built 2022-09-13 21:44:38 +0000 UTC]

**Interestingly** , the filebeat (0365 module) is working in another system running filebeat 8.2.3  
All config same across these systems

---

<div class="post-metadata">

### Author: ![sriramb12](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriramb12/32/110719_2.png) [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [September 21, 2022, 9:36am UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848/2 "2022-09-21T09:36:43Z")

</div>

Can admins create a separate tag for each module ? I dont find the tag matching o365 (or office365) ? It may help in searching quickly

---

<div class="post-metadata">

### Author: ![Tetiana\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tetiana_kravchenko/32/102683_2.png) [@Tetiana\_Kravchenko](https://discuss.elastic.co/u/Tetiana_Kravchenko)
#### Post date: [September 21, 2022, 3:36pm UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848/3 "2022-09-21T15:36:57Z")

</div>

Hi @sriramb12

Maybe you are you using OSS version of filebeat? This module is only available for the non-oss version of filebeat.

---

<div class="post-metadata">

### Author: ![sriramb12](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sriramb12/32/110719_2.png) [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [September 22, 2022, 3:17am UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848/4 "2022-09-22T03:17:12Z")

</div>

@Tetiana_Kravchenko  
Thanks. I followed these steps:  
[setup](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html)

```auto
echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

```

So it appears I have indeed installed **oss-8.x**? Can this step be branched to oss/non-oss ?  
Also, the lack of support for a module (say, o365) should throw a different error and may be point user to the right steps. I can file a bug ?  
thanks again, for your help!  
Sriram

---

<div class="post-metadata">

### Author: ![Tetiana\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tetiana_kravchenko/32/102683_2.png) [@Tetiana\_Kravchenko](https://discuss.elastic.co/u/Tetiana_Kravchenko)
#### Post date: [September 22, 2022, 7:52pm UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848/5 "2022-09-22T19:52:58Z")

</div>

Yes, you are using oss version, looking to the documentation - non-oss is already a default option

```auto
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

```

I wouldn't say that this is a bug, 'o365' is not available in the installed version of filebeat, this version is not aware about existence of this input.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2022, 9:53pm UTC](https://discuss.elastic.co/t/o365-module-no-such-input-type-exist-o365audit/314848/6 "2022-10-20T21:53:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
