This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
The Okta module collects events from the Okta API. Specifically this supports reading from the Okta System Log API.
Each fileset has separate variable settings for configuring the behavior of the
module. If you don’t specify variable settings, the
okta module uses
For advanced use cases, you can also override input settings. See Override input settings.
When you specify a setting at the command line, remember to prefix the
setting with the module name, for example,
system fileset settingsedit
The Okta System Log records system events related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems. This module is implemented using the httpjson input and is configured to paginate through the logs while honoring any rate-limiting headers sent by Okta.
This is an example configuration for the module.
- module: okta system: var.url: https://yourOktaDomain/api/v1/logs var.api_key: '00QCjAl4MlV-WPXM...0HmjFx-vbGua'
Specifies the URL to the Okta System Log API. Required.
Specifies the Okta API token to use in requests to the API. Required. The token is used in an HTTP
Authorizationheader with the
SSWSscheme. See Create an API token for information on how to obtain a token.
Duration of the time limit on HTTP requests made by the module. Defaults to
Duration between requests to the API. Defaults to
Boolean flag indicating if the original JSON event string should be included in
event.originalfield. Defaults to
Configuration options for SSL parameters like the certificate authority to use for HTTPS-based connections. If the
sslsection is missing, the host CAs are used for HTTPS connections to Okta. See SSL for more information.
var.ssl: supported_protocols: [TLSv1.2]
An initial interval can be defined. The first time the module starts, will fetch events from the current moment minus the initial interval value. Following restarts will fetch events starting from the last event read. It defaults to
var.initial_interval: 24h # will fetch events starting 24h ago.
This module comes with a sample dashboard:
For a description of each field in the module, see the exported fields section.
Intro to Kibana
ELK for Logs & Metrics