From 996272424c12b43c9eae88e02b050b385ca55e16 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Mon, 15 Apr 2024 13:08:09 +0930 Subject: [PATCH 1/2] x-pack/filebeat/input/o365audit: deprecate input --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/docs/inputs/input-o365audit.asciidoc | 4 ++++ x-pack/filebeat/input/o365audit/input.go | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 70c129b86975..8f9de2b8f0d7 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -257,6 +257,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] *Filebeat* - Deprecate `syslog` input in favor of `syslog` processor. {issue}37555[37555] {pull}38277[38277] +- Deprecate `o365audit` input in favor of `CEL` input. {issue}37719[37719] {pull}38922[38922] *Heartbeat* diff --git a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc index 62ec3880c256..e822f5e7e98a 100644 --- a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc @@ -5,6 +5,10 @@ [id="{beatname_lc}-input-{type}"] === Office 365 Management Activity API input +deprecated:[8.14.0] + +The o365audit input is deprecated. Similar functionality can be achieved using the <> . + ++++ Office 365 Management Activity API ++++ diff --git a/x-pack/filebeat/input/o365audit/input.go b/x-pack/filebeat/input/o365audit/input.go index 3793ce43d6aa..b01ba98ac907 100644 --- a/x-pack/filebeat/input/o365audit/input.go +++ b/x-pack/filebeat/input/o365audit/input.go @@ -55,7 +55,7 @@ func Plugin(log *logp.Logger, store cursor.StateStore) v2.Plugin { return v2.Plugin{ Name: pluginName, Stability: feature.Experimental, - Deprecated: false, + Deprecated: true, Info: "O365 logs", Doc: "Collect logs from O365 service", Manager: &cursor.InputManager{ From c8589e6304d4fe10b433ed707a64d888cc7b9520 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Tue, 16 Apr 2024 06:25:45 +0930 Subject: [PATCH 2/2] address pr comment --- x-pack/filebeat/docs/inputs/input-o365audit.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc index e822f5e7e98a..287e526f705e 100644 --- a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc @@ -7,7 +7,7 @@ deprecated:[8.14.0] -The o365audit input is deprecated. Similar functionality can be achieved using the <> . +The o365audit input is deprecated. For collecting Microsoft Office 365 log data, please use the https://docs.elastic.co/integrations/o365[Microsoft 365] integration package. For more complex or user-specific use cases, similar functionality can be achieved using the <> . ++++ Office 365 Management Activity API