# Office 365 module: data is not showing in dashboard and beat fails after 1 hour **URL:** \ **Category:** Beats\ **Tags:** beats-module\ **Created:** [August 27, 2021, 10:13pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709 "2021-08-27T22:13:49Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jared.smith](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@jared.smith](https://discuss.elastic.co/u/jared.smith)\ **Post date:** [August 27, 2021, 10:13pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/1 "2021-08-27T22:13:49Z")
After installing and configuring the Office 365 Module according to instructions [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-o365.html#filebeat-module-o365), I'm seeing a couple of issues. 1. After running successfully for (exactly) 1 hour, the o365beat process on the Windows 10 machine fails with an error like the following: ```auto ERROR instance/beat.go:916 Exiting: error listing all available content between 2021-08-27 20:32:33 +0000 UTC and 2021-08-27 15:43:44.6768062 -0500 CDT m=+3600.127845301: non-200 status during api request. confirm audit log searching is enabled for the target tenancy (https://docs.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search-on-or-off#turn-on-audit-log-search). Message: "Authorization has been denied for this request." ``` There's more to the error log but that's the essential part. However, the Audit Log feature is definitely enabled, which can be seen by running "Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled" in the Exchange Powershell. I disabled and re-enabled it, I've restarted the computer, the service, etc., numerous times across several days and still get the same issue. 1. No data shows up in the dashboard which comes with this module. I can see in the logs that data is being transferred, but there is no sign of it in the Kibana dashboard. Please advise ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [August 29, 2021, 11:20pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/2 "2021-08-29T23:20:17Z")
It looks like you're getting an error related to credentials/permissions. ---
**Author:** ![jared.smith](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@jared.smith](https://discuss.elastic.co/u/jared.smith)\ **Post date:** [September 7, 2021, 2:39pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/3 "2021-09-07T14:39:45Z")
Yes, but why after 1 hour? I finally resolved this auth issue by using the latest Filebeat download ([Download Filebeat • Lightweight Log Analysis | Elastic](https://www.elastic.co/downloads/beats/filebeat#ga-release)), still not sure why it happened, but it's not a problem any more. However, I'm still curious about the other issue, which is that absolutely no data shows up in the dashboard. "Module Status" shows that I'm correctly receiving data from the agent. Agent logs show that I'm connected just fine, but nothing appears in the dashboard, after days. Everything is properly authorized on the client side, audit log is enabled, etc. What am I missing? ![filebeat-o365-app-dashboards](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b4a194b49595f20566c7b43507dbcc8271073fed.jpeg) ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 7, 2021, 3:16pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/4 "2021-09-07T15:16:32Z")
Do you see data in the discover tab? If so then I suspect the dashboard is filtering on something that's preventing the data from showing. ---
**Author:** ![jared.smith](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@jared.smith](https://discuss.elastic.co/u/jared.smith)\ **Post date:** [September 7, 2021, 4:52pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/5 "2021-09-07T16:52:11Z")
No data appears in the Discover tab. ![filebeat-o365-app-discover-empty](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9fc2851dedddd1f3d268297b08d33ba052ae56ed.png) The filebeat 0365 agent log shows hundreds of entries like the following: | 2021-09-07T09:34:45.757-0500 | INFO | [monitoring] | log/log.go:145 | Non-zero metrics in the last 30s | {monitoring: {metrics: {beat:{cpu:{system:{ticks:454828,time:{ms:47}},total:{ticks:1506640,time:{ms:47},value:1506640},user:{ticks:1051812}},handles:{open:341},info:{ephemeral\_id:4e14a072-e267-438e-b7a1-09c48c2ecff5,uptime:{ms:592350191},version:7.14.0},memstats:{gc\_next:116944976,memory\_alloc:58793600,memory\_total:54508858752,rss:105738240},runtime:{goroutines:32}},filebeat:{harvester:{open\_files:0,running:0}},libbeat:{config:{module:{running:1}},output:{events:{active:2531},read:{bytes:210}},pipeline:{clients:5,events:{active:4120}}},registrar:{states:{current:0}}}}} | | --- | --- | --- | --- | --- | --- | | 2021-09-07T09:35:15.759-0500 | INFO | [monitoring] | log/log.go:145 | Non-zero metrics in the last 30s | {monitoring: {metrics: {beat:{cpu:{system:{ticks:454843,time:{ms:47}},total:{ticks:1506655,time:{ms:47},value:1506655},user:{ticks:1051812}},handles:{open:343},info:{ephemeral\_id:4e14a072-e267-438e-b7a1-09c48c2ecff5,uptime:{ms:592380188},version:7.14.0},memstats:{gc\_next:116944976,memory\_alloc:58952160,memory\_total:54509017312,rss:105738240},runtime:{goroutines:32}},filebeat:{harvester:{open\_files:0,running:0}},libbeat:{config:{module:{running:1}},output:{events:{active:2531},read:{bytes:210}},pipeline:{clients:5,events:{active:4120}}},registrar:{states:{current:0}}}}} | | 2021-09-07T09:35:45.752-0500 | INFO | [monitoring] | log/log.go:145 | Non-zero metrics in the last 30s | {monitoring: {metrics: {beat:{cpu:{system:{ticks:454984,time:{ms:109}},total:{ticks:1506968,time:{ms:281},value:1506968},user:{ticks:1051984,time:{ms:172}}},handles:{open:344},info:{ephemeral\_id:4e14a072-e267-438e-b7a1-09c48c2ecff5,uptime:{ms:592410215},version:7.14.0},memstats:{gc\_next:116943616,memory\_alloc:58471616,memory\_total:54512770440,rss:105766912},runtime:{goroutines:34}},filebeat:{harvester:{open\_files:0,running:0}},libbeat:{config:{module:{running:1}},output:{events:{active:2531},read:{bytes:210}},pipeline:{clients:5,events:{active:4120}}},registrar:{states:{current:0}}}}} | In the Exchange Powershell, the audit log is enabled: ![filebeat-o365-audit-log-enabled](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74cee3fa8d1b84b22088a72b00fa4ce26531f59c.png) ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 9, 2021, 11:38am UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/6 "2021-09-09T11:38:51Z")
Are you sure the credentials that you're using for Filebeat are good and have the right permissions. Its the only thing that I can presume based off the initial log message that you posted. ---
**Author:** ![jared.smith](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@jared.smith](https://discuss.elastic.co/u/jared.smith)\ **Post date:** [September 10, 2021, 3:47am UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/7 "2021-09-10T03:47:56Z")
I finally re-installed everything on the server side from scratch, and it's now working. While installing, I discovered that I had not done "filebeat setup" (on the server side) properly. At the least, logstash/filebeat were missing pipelines and probably other similar issues. I wish I could say exactly what was wrong, but at least it's working now. Thank you for your help, I really appreciate you being there. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 8, 2021, 9:26pm UTC](https://discuss.elastic.co/t/office-365-module-data-is-not-showing-in-dashboard-and-beat-fails-after-1-hour/282709/9 "2021-10-08T21:26:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.