Filebeat Okta module

filebeat/docs/modules/okta.asciidoc

@@ -0,0 +1,32 @@
+////
+This file is generated! See scripts/docs_collector.py
+////
+
+[[filebeat-module-okta]]
+[role="xpack"]
+
+:modulename: okta
+:has-dashboards: false
+
+== Okta module
+
+beta[]
+
+This is a filebeat module for retrieving system logs from Okta (www.okta.com) via API. 
+
+:has-dashboards!:
+
+This module comes with a sample dashboard. For example:
+
+[role="screenshot"]
+image::./images/filebeat-okta-dashboard.png[]
+
+:modulename!:
+
+
+[float]
+=== Fields
+
+For a description of each field in the module, see the
+<<exported-fields-okta,exported fields>> section.
+

filebeat/docs/modules_list.asciidoc

@@ -29,6 +29,7 @@ This file is generated! See scripts/docs_collector.py
   * <<filebeat-module-nats>>
   * <<filebeat-module-netflow>>
   * <<filebeat-module-nginx>>
+  * <<filebeat-module-okta>>
   * <<filebeat-module-osquery>>
   * <<filebeat-module-panw>>
   * <<filebeat-module-postgresql>>
@@ -70,6 +71,7 @@ include::modules/mysql.asciidoc[]
 include::modules/nats.asciidoc[]
 include::modules/netflow.asciidoc[]
 include::modules/nginx.asciidoc[]
+include::modules/okta.asciidoc[]
 include::modules/osquery.asciidoc[]
 include::modules/panw.asciidoc[]
 include::modules/postgresql.asciidoc[]

x-pack/filebeat/filebeat.reference.yml

@@ -669,6 +669,16 @@ filebeat.modules:
   #  # Filebeat will choose the paths depending on your OS.
   #  #var.paths:
 
+#--------------------------------- Okta Module ---------------------------------
+- module: okta
+  system:
+    enabled: true
+    # API key to access Okta
+    #var.api_key
+
+    # URL of the Okta REST API
+    #var.url
+
 #------------------------------- Osquery Module -------------------------------
 - module: osquery
   result:

x-pack/filebeat/input/httpjson/input.go

@@ -312,12 +312,14 @@ func (in *HttpjsonInput) processHTTPRequest(ctx context.Context, client *http.Cl
 		switch obj := m.(type) {
 		// Top level Array
 		case []interface{}:
+			in.log.Info("Processed:", len(obj))
 			mm, err = in.processEventArray(obj)
 			if err != nil {
 				return err
 			}
 		case map[string]interface{}:
 			if in.config.JSONObjects == "" {
+				in.log.Info("Processed:", len(obj))
 				mm, err = in.processEventArray([]interface{}{obj})
 				if err != nil {
 					return err
@@ -329,6 +331,7 @@ func (in *HttpjsonInput) processHTTPRequest(ctx context.Context, client *http.Cl
 				}
 				switch ts := v.(type) {
 				case []interface{}:
+					in.log.Info("Processed:", len(ts))
 					mm, err = in.processEventArray(ts)
 					if err != nil {
 						return err

x-pack/filebeat/module/okta/README.md

@@ -0,0 +1,24 @@
+# Okta module
+
+## Caveats
+
+* Module is to be considered _beta_.
+
+## How to try the module from distribution install
+
+
+```
+./filebeat setup --modules=okta -e --dashboards
+```
+
+Enable the Okta module
+
+```
+./filebeat modules enable okta
+```
+
+Start Filebeat
+
+```
+./filebeat -e
+```

x-pack/filebeat/module/okta/_meta/config.yml

@@ -0,0 +1,8 @@
+- module: okta
+  system:
+    enabled: true
+    # API key to access Okta
+    #var.api_key
+
+    # URL of the Okta REST API
+    #var.url

x-pack/filebeat/module/okta/_meta/docs.asciidoc

@@ -0,0 +1,19 @@
+[role="xpack"]
+
+:modulename: okta
+:has-dashboards: false
+
+== Okta module
+
+beta[]
+
+This is a filebeat module for retrieving system logs from Okta (www.okta.com) via API. 
+
+:has-dashboards!:
+
+This module comes with a sample dashboard. For example:
+
+[role="screenshot"]
+image::./images/filebeat-okta-dashboard.png[]
+
+:modulename!:

x-pack/filebeat/module/okta/_meta/fields.yml

@@ -0,0 +1,11 @@
+- key: okta
+  title: Okta
+  description: >
+    Module for handling system logs from Okta.
+  fields:
+    - name: okta
+      type: group
+      default_field: false
+      description: >
+        Fields from Okta.
+      fields: