Okta module in filebeat retrieving an error failed to find message

Elastic Stack Beats
,
1

Hi all, i am using the filebeat to ship the logs from Okta to elasticsearch, connection established successfully and elaticsearch is receiving the event.dataset from okta when i look into the log messages it's showing failed to find message attached sample logs for reference.

    16:41:15.656       okta.system       failed to find message

    16:41:16.656       okta.system       failed to find message

module.yml

    - module: okta
      system:
        enabled: true
        var.url: https://dfdxxxx.okta.com/api/v1/logs
        var.api_key: '0xxxxxKXoqQ45654363v7CMzxxxxxpz'

Could some one help me to resolve this issue? Thanks in advance

2

Hi @Mohan_vel :slightly_smiling_face:

Can you post a full log running metricbeat with metricbeat -e -d "*", please? At first sight I don't see anything wrong in your config

3

Hi @Mario_Castro,

Thanks for the reply as suggested i have given my log of filebeat might be helpful to you reach me in case if need any more clarification.

My filebeat command : .\filebeat.exe -c filebeat.yml -e 

    2020-06-18T23:10:35.752+0530    INFO    [publisher_pipeline_output]     pipeline/output.go:111  Connection to backoff(elasticsearch(https://d6b421cb7csg6fg28e97a748730c5.eastus2.azure.elastic-cloud.com:9243)) established
    2020-06-18T23:10:35.791+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592225702381_2     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:36.202+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592243828313_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:36.602+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592245378996_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:37.011+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592297516961_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:37.465+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592389227010_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:37.930+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592470669470_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:38.349+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592486666699_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}
    2020-06-18T23:10:38.719+0530    INFO    [httpjson]      httpjson/input.go:374   Continuing with pagination to URL: https://dev-dfdxxxx.okta.com/api/v1/logs?after=1592491927890_1     {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}

    2020-06-18T23:11:38.964+0530    INFO    [httpjson]      httpjson/input.go:443   Process another repeated request.       {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}

    2020-06-18T23:11:38.964+0530    INFO    [httpjson]      httpjson/input.go:443   Process another repeated request.       {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}

    2020-06-18T23:11:38.964+0530    INFO    [httpjson]      httpjson/input.go:443   Process another repeated request.       {"url": "https://dev-dfdxxxx.okta.com/api/v1/logs"}

Process another repeated request. This is what repeated.

4

Hi @Mario_Castro,

Any update.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.