x-pack/filebeat/input/o365audit: deprecate input

elastic · Apr 15, 2024 · 9962724 · 9962724
1 parent 8105935
commit 9962724
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -257,6 +257,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 *Filebeat*
 
 - Deprecate `syslog` input in favor of `syslog` processor. {issue}37555[37555] {pull}38277[38277]
+- Deprecate `o365audit` input in favor of `CEL` input. {issue}37719[37719] {pull}38922[38922]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc
@@ -5,6 +5,10 @@
 [id="{beatname_lc}-input-{type}"]
 === Office 365 Management Activity API input
 
+deprecated:[8.14.0]
+
+The o365audit input is deprecated. Similar functionality can be achieved using the <<filebeat-input-cel,`CEL input`>> .
+
 ++++
 <titleabbrev>Office 365 Management Activity API</titleabbrev>
 ++++

diff --git a/x-pack/filebeat/input/o365audit/input.go b/x-pack/filebeat/input/o365audit/input.go
@@ -55,7 +55,7 @@ func Plugin(log *logp.Logger, store cursor.StateStore) v2.Plugin {
 	return v2.Plugin{
 		Name:       pluginName,
 		Stability:  feature.Experimental,
-		Deprecated: false,
+		Deprecated: true,
 		Info:       "O365 logs",
 		Doc:        "Collect logs from O365 service",
 		Manager: &cursor.InputManager{