# Office 365 Logs - Struggling to get data in

**URL:** https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015
**Category:** Beats
**Tags:** filebeat
**Created:** [June 23, 2022, 1:32pm UTC](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015 "2022-06-23T13:32:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rosssymons](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@rosssymons](https://discuss.elastic.co/u/rosssymons)
#### Post date: [June 23, 2022, 1:32pm UTC](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015/1 "2022-06-23T13:32:01Z")

</div>

I've configured the Office 365 Logs integration but I'm struggling to get the data in. In my logs I'm seeing these lines:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/b/ab80f22888461ad708285bc72e846507b34b24bd.png)

I'm not sure what 'currently in use, waiting...' is in reference to.

I think all my config is correct, the only bit I wasn't sure about when configuring the Agent Policy was this field "Directory (tenant) domains mapping".

Before editing, the field is pre-filled with "tenant-id: domain-name", whereas in the documentation it appears to just write out the domains. Should this be formatted as:

[mydomain@domain.com](mailto:mydomain@domain.com)  
mytenantid: [mydomain@domain.com](mailto:mydomain@domain.com)

I also have 9 custom domain on my tenant, should I be adding each of these or just the [mydomain.onmicrosoft.com](http://mydomain.onmicrosoft.com) domain?

This might not even be the issue but thought I'd get some clarification!

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2022, 3:32pm UTC](https://discuss.elastic.co/t/office-365-logs-struggling-to-get-data-in/308015/2 "2022-07-21T15:32:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
