Comments (5)
Thanks for the issue, I hope we can get things squared away for you. A couple quick questions:
- Did you run
o365beat setup
against your elastic instance, before shipping logs, and is kibana running on that same system? - Did you make any significant modifications to your
o365beat.yml
file? If possible, could you add it to this issue (after removing sensitive information like IDs and client secret)? - By default, the visualizations should use the default index pattern
o365beat-*
... do you have that pattern in kibana?
Thanks again. If you'd rather work through this via email, you can reach me at [email protected].
from o365beat.
from o365beat.
You definitely don't need to install the beat on all the nodes, or even on any of them (it could be running on a separate box, we see it often run on logstash boxes for example).
By default, the o365beat setup
command assumes kibana is on localhost:5601
, the same as other beats. If you have a more complex setup, you'll need to change your config file accordingly (o365beat.yml
). Specifically, you'll need to update setup.kibana.host
(which defaults to localhost:5601
) and all its supporting settings. You can see these options, commented out, on these lines of the o365beat.reference.yml
reference file, and the filebeat docs do a good job of walking through this too ... it generally works the same as o365beat.
If your kibana setup is correct in the config, it's possible your elasticsearch config wasn't. If you send me your (redacted) config file by email, we can sort through any remaining issues. Thanks for your patience!
from o365beat.
from o365beat.
As noted in #43: while researching another issue, I realized (a few months late) that filebeat now supports o365 with an official module, as of v7.7.0. It supports a variety of visualizations out of the box, and will surely stay more current with the latest updates to the Elastic Stack, including Kibana. It's probably the best solution for you going forward, if you haven't already migrated that way.
Given there's an "official solution" to visualization, and their documentation regarding Kibana setups is more thorough, I'm going to close this issue. Apologies that it went unaddressed for so long. Thanks for engaging with the project!
from o365beat.
Related Issues (20)
- Exiting: error loading config file: yaml: line 2: did not find expected node content HOT 5
- Understanding Authentication Data HOT 4
- Client.Timeout for Exchange/General/Sharepoint HOT 6
- Docker Instructions HOT 3
- Parsing Extended Properties HOT 4
- Preventing Duplicate Events HOT 4
- Dashboard and visualizations not working - error with fields.keyword HOT 5
- Logstash connection errors HOT 7
- o365 audit.exchange not returning threat audit logs HOT 3
- WARN beater/o365beat.go:249 start XX must be <=YY hrs ago, resetting HOT 3
- Live Realoding Credentials HOT 2
- Proxy support for the API requests HOT 1
- Certificate signed by unknown authority message HOT 2
- AzureActiveDirectory Logs not pulled HOT 3
- Log content changed recently?
- GCC High no available content locations: HOT 1
- Tenant ID not found
- Does O365beat support multiple Office 365 tenants scenario
- Log file is not getting created
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from o365beat.