Salesforce Integration - Resolving Salesforce instance URL Error

Elastic Observability Logs
1

I’m configuring the Salesforce Integration as described here: Salesforce Integration | Elastic integrations

I am able to authenticate and generate an Salesforce Access Token using the test script in the document but whenever I try to deploy the integration, the integration on the agent shows as healthy but all of the pre-build integration dashboards return the error - “Could not locate field: salesforce.instance_url:

Error_salesforce.instance_url
Error_salesforce.instance_url662×205 14.2 KB

Has anyone else run into this error? I’ve tested using a number of possible URLs but all return the same error and I’m not able to get any other details around the error. The only other thing I can think of API Version but I don’t think would match the error message.

2

What is the integration version that you are using?

I'm on the last version and does not have this issue, also, there is a built-in extra filter that is not present in your screenshot.

image
image822×203 13.9 KB

3

I have just updated to 1.6. On the Elastic Agent, this is the error I see:

Input 'salesforce' failed with: input salesforce-salesforce.setupaudittrail-c780efe2-4013-4f74-837a-88109109f211 failed: error setting up connection to Salesforce: failed to open salesforce connection: session response error: 400 400 Bad Request

4

Do you have the correct license on Salesforce side?

You need to have the Shield license to be able to get the Login/Logout information.

5

Yes, but instead of shield, the license for Salesforce Export Monitoring was purchases which allows for export. In salesforce, Login, log out, setupaudit trail, and apex events are enabled and configured per integration doc.

6

So you do not have Shield, I'm not sure that other license will work with the integration.

The Login, Logout and Apex Events requires that your license level supports Real-Time Event Monitoring, I know that the Shield licenses allows that, not sure if this other license works.

I've had the same error when I tried to enable the Login and Logout data sets and didn't have the correct license.

7

The event monitoring add-on grants access to event monitoring. Within event manager, Login Event, Logout Event, Apex, Setupaudittrail all have event storage enabled.

8

I think you need to validate first with Salesforce if your license allows Real-Time monitoring.

Do a quick test, disable the Login, Logout and Apex datasets and check if you get any log for Setupaudittrail.

Also, something that was confusing the first time I configured is if you use a security token, you need to append it to your password while configuring the integration.

9

Update: turns out the issue was related to IP restrictions. After relaxing IP restrictions in the Salesforce App Configuration settings, the 400 error codes have resolved. This has allowed both the salesforce.logout and salesforce.setupaudittrail log streams to be ingested. However, both apex and login event streams are not yet being ingested. The current error being thrown on the elastic agent is:

Error running EventLogFile collection: error fetching log file: Get "https://<instance_id>.salesforce.com/services/data/v65.0/sobjects/EventLogFile/0ATRd000003CqcEOAS/LogFile": context deadline exceeded (Client.Timeout exceeded while awaiting headers)