# Office 365 Module - not an IP string literal **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [May 15, 2020, 12:11am UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727 "2020-05-15T00:11:36Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ericbarnes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericbarnes/32/31868_2.png) [@ericbarnes](https://discuss.elastic.co/u/ericbarnes)\ **Post date:** [May 15, 2020, 12:11am UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/1 "2020-05-15T00:11:36Z")
Getting the following error with default o365 module setup. Casual glance seems to say this is mostly happening on Exchange related audit data but not enough to know yet. ```auto May 14 16:51:23 ainfcp1esl00001 filebeat: 2020-05-14T16:51:23.611-0700#011WARN#011[elasticsearch]#011elasticsearch/client.go:384#011Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63724844335, loc:(*time.Location)(nil)}, Meta:{"_id":"17efaaf6-8bb5-4829-27b1-08d7f6153bf3","pipeline":"filebeat-7.7.0-o365-audit-pipeline"}, Fields:{"agent":{"ephemeral_id":"c7b7e853-c8ba-4749-80e0-b52d98db95ed","hostname":"hostname.com","id":"9ff5gad7-a611-4443-bc73-3d377f156e21","type":"filebeat","version":"7.7.0"},"client":{"address":"[1.2.2.3]:7972","ip":"[1.2.2.3]","port":"7972"},"domain":"domain.com","ecs":{"version":"1.5.0"},"error":{"message":"GoError: cannot override existing key with `client.ip`"},"event":{"action":"Create","category":"web","code":"ExchangeItem","dataset":"o365.audit","id":"17efaag6-7bb5-4829-27b1-08d7f6153bf3","kind":"event","module":"o365","outcome":"success","provider":"Exchange","type":"info"},"fields":{},"fileset":{"name":"audit"},"host":{"architecture":"x86_64","containerized":false,"hostname":"hostname.com","id":"a962373b0c22485eae53ee6e404cd357","ip":["10.1.2.200"fe80::e75a:ad3:88ff:1ad0"],"mac":["00:50:56:a7:f8:4d"],"name":"hostname.com","os":{"codename":"Core","family":"redhat","kernel":"3.10.0-1127.el7.x86_64","name":"CentOS Linux","platform":"centos","version":"7 (Core)"}},"input":{"type":"o365audit"},"o365audit":{"ClientIP":"[1.2.2.3]:7972","ClientIPAddress":"[1.2.2.3]:7972","ClientInfoString":"Client=MSExchangeRPC","ClientProcessName":"OUTLOOK.EXE","ClientVersion":"16.0.12730.20144" ... , Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [client.ip] of type [ip] in document with id '17efaaf6-8bb5-4829-27b1-08d7f6153bf3'. Preview of field's value: '[1.2.2.3]'","caused_by":{"type":"illegal_argument_exception","reason":"'[1.2.2.3]' is not an IP string literal."}} ``` ---
**Author:** ![drknudsen](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@drknudsen](https://discuss.elastic.co/u/drknudsen)\ **Post date:** [May 15, 2020, 10:17am UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/2 "2020-05-15T10:17:49Z")
Got the same issue, cant index any log inputs from O365 in my setup. (Update, some data have started to be indexed, might have been a template thing). ---
**Author:** ![flxdan](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@flxdan](https://discuss.elastic.co/u/flxdan)\ **Post date:** [May 15, 2020, 11:44am UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/3 "2020-05-15T11:44:13Z")
Also seeing the same issue, with exchange events - i notice earlier on in the warning message the following: "error":{"message":"GoError: cannot override existing key with `client.ip`"} Unfortunately I don't understand enough about what is happening to work out what is going on - anyone? I should note that some data does get into elastic, just not events where this is happening. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 15, 2020, 3:23pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/4 "2020-05-15T15:23:05Z")
Thanks for reporting, I've created the following issue [https://github.com/elastic/beats/issues/18587](https://github.com/elastic/beats/issues/18587) and will submit a fix asap. In our tests we observed that this field will be `ipv4:port` or `[ipv6]:port`, but never `[ipv4]:port`. There's no reason to surround an IPv4 in brackets. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 15, 2020, 4:45pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/5 "2020-05-15T16:45:34Z")
Here's the candidate fix PR: [#18591](https://github.com/elastic/beats/pull/18591) For those affected by this problem, can you try replacing your existing `module/o365/audit/config/pipeline.js` with this one: [https://raw.githubusercontent.com/elastic/beats/665ee9a50e9483e696bd772b941a9bef9089cc35/x-pack/filebeat/module/o365/audit/config/pipeline.js](https://raw.githubusercontent.com/elastic/beats/665ee9a50e9483e696bd772b941a9bef9089cc35/x-pack/filebeat/module/o365/audit/config/pipeline.js) To see if that solves the problem in all cases. ---
**Author:** ![ericbarnes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericbarnes/32/31868_2.png) [@ericbarnes](https://discuss.elastic.co/u/ericbarnes)\ **Post date:** [May 15, 2020, 8:03pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/6 "2020-05-15T20:03:39Z")
So I've added this and it "seems" to be working. I'll monitor for a bit and let you know if I see anything else. ---
**Author:** ![flxdan](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@flxdan](https://discuss.elastic.co/u/flxdan)\ **Post date:** [May 18, 2020, 1:57pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/7 "2020-05-18T13:57:32Z")
Many thanks, the fix seems to be working well for me too. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 19, 2020, 1:11pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/9 "2020-05-19T13:11:40Z")
The fix will be released in 7.7.1 and 7.8.0. Until then the workaround is to apply the patch above. ---
**Author:** ![nateut](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@nateut](https://discuss.elastic.co/u/nateut)\ **Post date:** [May 30, 2020, 2:25pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/10 "2020-05-30T14:25:25Z")
We saw the same error message with client.port in our Exchange audit data... not nearly as prevalent as client.ip though. error":{"message":"GoError: cannot override existing key with `client.port` "} ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [June 3, 2020, 4:40pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/11 "2020-06-03T16:40:03Z")
@nateut this is after updating to the pipeline above? If so, can you share a full document with this error? ---
**Author:** ![nateut](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@nateut](https://discuss.elastic.co/u/nateut)\ **Post date:** [June 9, 2020, 4:27pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/12 "2020-06-09T16:27:14Z")
Haven't seen it since we upgraded to 7.7.1... thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 7, 2020, 4:27pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727/13 "2020-07-07T16:27:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.