search

counteractive / o365beat

Elastic Beat for fetching and shipping Office 365 audit events
Other
66 stars 27 forks source link

Live Realoding Credentials #51

Closed cloudziu closed 4 years ago

cloudziu commented 4 years ago

Hello, First of all great job guys with the beat!

I would like to ask if there is a possibility to add Live Reload feature. Something similar to this.

filebeat.config.inputs:
  enabled: true
  path: configs/*.yml
  reload.enabled: true
  reload.period: 10s

What I would like to achieve is creating external confile with credentials, and be able to change it without restarting the beat. If this is achievable, are you planning to add this ?

chris-counteractive commented 4 years ago

@cloudziu thanks for the issue! I'll take a look at this and see what we can do. Filebeat's live reload has a couple caveats: they don't actually support live reloading of the main config file (filebeat.yml), and they implement it by polling, checking the file every reload.period, which can introduce extra overhead.

Out of curiosity, what's the use-case where you'd be changing credentials without the ability to restart the service?

chris-counteractive commented 4 years ago

@cloudziu in researching how filebeat handles this, I realized (a few months late) that filebeat now supports o365 with an official module, as of v7.7.0. It might be that's a better solution for you going forward - and in any case, we're going to feature freeze given that there's an "official" tool now.

Thanks for prompting the search that helped us find this out, hope this helps.