Work with the Google Workspace Beat

Modify the Google Workspace Beat Configuration File

If you need to change the credentials for the configuration file:

1. Run the following command:

   ./lrctl gsbeat config edit

2. Follow all steps in the Authorize the Application section again.

After you've re-added the credentials, restart the Beat with the following command:

Upgrade the Beat

To upgrade the gsbeat to latest version , run below command.

This will automatically apply migration to the gsbeat.

Troubleshoot the Beat

• To help determine what the issue is, export gsbeat logs using following command:

This outputs a .tar.gz file.

• Token Logs - In gsbeat, if we configure Token application to collect logs from portal then we will get token generation/refresh
  token logs along with activity logs for each api call (Which depends on Period, by default it is set to 10 Sec) from our gsbeat to portal.

Below is the sample log for token generation/refresh token.

{"@timestamp":"2020-05-28T14:39:01.839Z","@metadata":{"beat":"gsbeat","type":"doc","version":"8.0.0"},"response":{"ipAddress":"65.127.112.131","kind":"admin#reports#activity","actor":{"email":"admin@logrhythmbeat.com","profileId":"111125665335280792825"},"etag":""JDMC8884sebSczDxOtZ17CIssbQ/wCX8cKFWIuk9zH9gk95pVKqhluw"","events":[{"parameters":[{"name":"clientid","value":"1092507212899-lg4f1rmdl2jgj6b4ddtkej1glea7s4lj.apps.googleusercontent.com"},{"name":"appname","value":"LogRhythm"},{"name":"clienttype","value":"NATIVEAPPLICATION"},{"name":"scopedata"},{"multiValue":["https://www.googleapis.com/auth/admin.reports.audit.readonly"],"name":"scope"}],"name":"authorize"}],"id":{"applicationName":"token","customerId":"C00hgmtek","time":"2020-05-28T14:38:32.254Z","uniqueQualifier":"2323310303217398317"}},"ecs":{"version":"1.0.0-beta2"},"agent":{"version":"8.0.0","type":"gsbeat","ephemeral_id":"419844bc-76ac-443d-acee-29390cf75628","hostname":"AU-GL-Win10","id":"8fb7163c-7821-4ab7-897e-ce2a4f43ddf9"},"host":{"name":"AU-GL-Win10"}}

If you do not want to listen to these logs in your gsbeat, do not include token in the application list within the .yaml file.