Office 365 Filebeat Module Error

[khaag (Kevin Haag)]

Hello

We're trying to setup the office 365 module in filebeat.
After editing the o365.yml file we are getting the following error:

ERROR instance/beat.go:932 Exiting: Error while initializing input: o365audit: reading config: string value is not set accessing 'application_id'

Does someone maybe have an idea

Kind regards
Kevin

[Mario_Castro]

Hi @khaag

I'm not expert in O365 module but looking at the docs, it seems that you need to define an application_id or var.application_id when configuring the module https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-o365.html and the error is telling you that the field is missing or empty, I guess.

[khaag (Kevin Haag)]

Hi @Mario_Castro

Thank you for your reply!

In the module config o365.yml i did set the var.application_id: "xxxxx"

Like this:

# Set the application_id (also known as client ID):
var.application_id: "eff3698b-59e6-4bdf-88fe0322f16e1bcb"

But this does't work for me...

[Mario_Castro]

Just to double check, this must be placed in audit after enabling Audit log search and the application must be registered in Azure

[khaag (Kevin Haag)]

Hi @Mario_Castro

We figured it out There was one more dash in the application id
Sorry for wasting the time!

And many thanks for your reply!

Regards
Kevin

[Mario_Castro]

That things happen