Office 365 Logs - Struggling to get data in

Elastic Stack Beats
1

I've configured the Office 365 Logs integration but I'm struggling to get the data in. In my logs I'm seeing these lines:

image
image1471×284 57.5 KB

I'm not sure what 'currently in use, waiting...' is in reference to.

I think all my config is correct, the only bit I wasn't sure about when configuring the Agent Policy was this field "Directory (tenant) domains mapping".

Before editing, the field is pre-filled with "tenant-id: domain-name", whereas in the documentation it appears to just write out the domains. Should this be formatted as:

mydomain@domain.com
mytenantid: mydomain@domain.com

I also have 9 custom domain on my tenant, should I be adding each of these or just the mydomain.onmicrosoft.com domain?

This might not even be the issue but thought I'd get some clarification!

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.