In the GitHub issue #23023, a bug is fixed in the httpjson module that caused Filebeat to continue requesting data from Okta even after the rate-limit has been reached.
However, Okta continues to tag Filebeat behavior as rate-limit violations, as Okta apparently considers making the full limit of requests a "violation".
Filebeat only "waits" after it hits 0 remaining (which Okta calls a Violation) -- e.g. when Okta says there is "1 remaining", then Filebeat sends 1 more, and then Okta calls that a "Violation".
The Okta team has responded:
Per my team here, the violation is expected as you are effectively hitting the violation threshold/limit. To prevent this, the recommendation would not be to wait until the 120 calls, but to set the threshold to 90% to prevent this from occurring in general.
On the ticket above, I ask about adding a new configuration option to configure Filebeat to back-off earlier then when remaining is zero. As that ticket is closed, a new ticket for this feature request is probably more appropriate. The contributing guidelines in the Beats repo suggests creating a discussion post (this) before creating new issues in GitHub.