x-pack/filebeat/input/o365audit: deprecate input

CHANGELOG.next.asciidoc

@@ -257,6 +257,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 *Filebeat*
 
 - Deprecate `syslog` input in favor of `syslog` processor. {issue}37555[37555] {pull}38277[38277]
+- Deprecate `o365audit` input in favor of `CEL` input. {issue}37719[37719] {pull}38922[38922]
 
 *Heartbeat*
 

x-pack/filebeat/docs/inputs/input-o365audit.asciidoc

@@ -5,6 +5,10 @@
 [id="{beatname_lc}-input-{type}"]
 === Office 365 Management Activity API input
 
+deprecated:[8.14.0]
+
+The o365audit input is deprecated. Similar functionality can be achieved using the <<filebeat-input-cel,`CEL input`>> .
+
 ++++
 <titleabbrev>Office 365 Management Activity API</titleabbrev>
 ++++

x-pack/filebeat/input/o365audit/input.go

@@ -55,7 +55,7 @@
 	return v2.Plugin{
 		Name:       pluginName,
 		Stability:  feature.Experimental,
-		Deprecated: false,
+		Deprecated: true,
 		Info:       "O365 logs",
 		Doc:        "Collect logs from O365 service",
 		Manager: &cursor.InputManager{
@@ -117,7 +117,7 @@
 		if err == nil {
 			break
 		}
 		if ctx.Cancelation.Err() != err && err != context.Canceled {
 			msg := mapstr.M{}
 			msg.Put("error.message", err.Error())
 			msg.Put("event.kind", "pipeline_error")
@@ -125,10 +125,10 @@
 				Timestamp: time.Now(),
 				Fields:    msg,
 			}
 			publisher.Publish(event, nil)
 			ctx.Logger.Errorf("Input failed: %v", err)
 			ctx.Logger.Infof("Restarting in %v", inp.config.API.ErrorRetryInterval)
 			timed.Wait(ctx.Cancelation, inp.config.API.ErrorRetryInterval)
 		}
 	}
 	return nil
@@ -257,14 +257,14 @@
 		}
 	}
 	if env.Config.PreserveOriginalEvent {
 		b.PutValue("event.original", string(raw))
 	}
 	if len(errs) > 0 {
 		msgs := make([]string, len(errs))
 		for idx, e := range errs {
 			msgs[idx] = e.Error()
 		}
 		b.PutValue("error.message", msgs)
 	}
 	return b
 }