o365 message trace input: changed from basic auth to oauth and the input fails now with this error
o365 message trace input: changed from basic auth to oauth and the input fails now with this error
{
"time": "2023-04-10T23:00:12.531Z",
"cid": "w1",
"channel": "TaskExecutor",
"level": "error",
"message": "failed to execute task",
"jobId": "1681167600.54.scheduled.CD_o365_msg_traces:MessageTrace",
"taskId": "collect.1",
"host": "hostname",
"reason": {
"message": "Non-whitespace before {[.\nLine: 3\nColumn: 1\nChar: 60",
"stack": "Error: Non-whitespace before {[.\nLine: 3\nColumn: 1\nChar: 60\n at v (/opt/cribl_w/bin/cribl.js:14:9579357)\n at p._ [as write] (/opt/cribl_w/bin/cribl.js:14:9580223)\n at y.write (/opt/cribl_w/bin/cribl.js:14:17538090)\n at S._transform (/opt/cribl_w/bin/cribl.js:14:17539431)\n at S.Transform._write (node:internal/streams/transform:205:23)\n at writeOrBuffer (node:internal/streams/writable:391:12)\n at _write (node:internal/streams/writable:332:10)\n at S.Writable.write (node:internal/streams/writable:336:10)\n at IncomingMessage.ondata (node:internal/streams/readable:754:22)\n at IncomingMessage.emit (node:events:513:28)"
},
"source": "/opt/cribl_l/state/jobs/default/1681167600.54.scheduled.CD_o365_msg_traces:MessageTrace/logs/task/tasklog.log"
}
What could be the reason for that?
Answers
-
Did you get past this issue? Also, does anyone have a recommendation on the Date Range Start/End to compensate for the delays in message trace data? Lets say I run the input every 6 minutes, ideally I would want to pull in the last 6 min of data each time it runs. But with it being delayed, what should I choose? Also I want to minimize the number of duplicate messages pulled down.
0 -
Ok I am seeing this error as well, just FYI. It pulls in 2000 records and then pukes
0
