diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 46222825257..3d06a3ddaed 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -165,6 +165,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix `cisco` asa and ftd parsing of messages 106102 and 106103. {pull}20469[20469]
 - Fix event.kind for system/syslog pipeline {issue}20365[20365] {pull}20390[20390]
 - Fix event.type for zeek/ssl and duplicate event.category for zeek/connection {pull}20696[20696]
+- Fix Okta default date formatting. {issue}24018[24018] {pull}24025[24025]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/module/okta/system/config/input.yml b/x-pack/filebeat/module/okta/system/config/input.yml
index 107dd3ca320..be1634d73ae 100644
--- a/x-pack/filebeat/module/okta/system/config/input.yml
+++ b/x-pack/filebeat/module/okta/system/config/input.yml
@@ -25,7 +25,7 @@ request.transforms:
   - set:
       target: url.params.since
       value: "[[.cursor.published]]"
-      default: '[[now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}")) "RFC3339"]]'
 
 response.pagination:
   - set: