Search code examples
elasticsearchkibanapipelineelastic-stackelk

field [o365audit] not present as part of path [o365audit.CreationTime]

I suddenly started to getting the error: field [o365audit] not present as part of path [o365audit.CreationTime]

Integration: Office 365 Logs Version: 1.4.1 Agent Version: 7.17.3

I cannot get the logs, could you please help?

I also tried to change the ingest pipeline to see from o365audit.CreationTime to o365.audit.CreationTime BCS of the log schema

image

but this time gave the error field [o365] not present as part of path [o365.audit.CreationTime]

Solution

  • Finally, the problem solved.

    1. First, I've checked the related fields on the pipeline.

    enter image description here

    1. Then I wondered what is gonna happen after ignoring the failures.

    enter image description here

    1. Saved the pipeline and checked the logs.

    unable to acquire authentication token for tenant:xxx: refreshing spt token: : Refresh request failed. Status Code = '401'. Response body: {"error":"invalid_client","error_description":"AADSTS7000222: The provided client secret keys for app 'xxxx' are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.\r\nTrace

    1. This means the secret key is expired. Created new key and edited the integration. Problem solved.