[Filebeat] Okta module uses incorrect time format in HTTP request

[andrewkroh]

In @SpencerLN's own words:

We upgraded to Filebeat 7.11.0 today and are seeing an issue with the Okta module. It looks like it is not formatting the since timestamp correctly before sending it to Okta. Okta expects ISO 8601, but it is sending since=2021-02-10+16%3A59%3A19.699851+%2B0000+UTC . Setting formatDate for RFC3339 in the input.yml seems to get it working:

  - set:
      target: url.params.since
      value: "[[.cursor.published]]"
      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}")) "RFC3339"]]'

For confirmed bugs, please report:

• Version: 7.11.0
• Operating System: all

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[untergeek]

#24479 appears to be a duplicate