Office 365 Filebeat Module Error

Elastic Stack Beats
,
1

Hello

We're trying to setup the office 365 module in filebeat.
After editing the o365.yml file we are getting the following error:

ERROR instance/beat.go:932 Exiting: Error while initializing input: o365audit: reading config: string value is not set accessing 'application_id'

Does someone maybe have an idea :slight_smile:

Kind regards
Kevin

2

Hi @khaag :slightly_smiling_face:

I'm not expert in O365 module but looking at the docs, it seems that you need to define an application_id or var.application_id when configuring the module https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-o365.html and the error is telling you that the field is missing or empty, I guess.

3

Hi @Mario_Castro

Thank you for your reply!

In the module config o365.yml i did set the var.application_id: "xxxxx"

Like this:

# Set the application_id (also known as client ID):
var.application_id: "eff3698b-59e6-4bdf-88fe0322f16e1bcb"

But this does't work for me...

4

Just to double check, this must be placed in audit after enabling Audit log search and the application must be registered in Azure

5

Hi @Mario_Castro

We figured it out :slight_smile: There was one more dash in the application id :see_no_evil:
Sorry for wasting the time!

And many thanks for your reply!

Regards
Kevin

6

That things happen :smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.