{"log.level":"info","@timestamp":"2025-06-25T14:21:46.596-0700","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch","file.name":"instance/beat.go","file.line":542},"message":"filebeat stopped.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-06-25T14:21:46.596-0700","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1355},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: running a FIPS-capable distribution but input [o365audit] is not FIPS capable","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: Failed to start crawler: starting input failed: error while initializing input: running a FIPS-capable distribution but input [o365audit] is not FIPS capable

$ mage clean && FIPS=true mage build

$ cat <<EOF > filebeat-test-input.yml
filebeat.inputs:
- type: o365audit
  id: id-nofips
  enabled: true
  application_id: foo
  tenant_id: bar
  client_secret: qux

output.console:
  enabled: true
EOF
$ ./filebeat -c ./filebeat-test-input.yml -e

$ cat <<EOF > filebeat-test-module.yml
filebeat.modules:
- module: o365
  audit:
    enabled: true
    var.application_id: "<MyApplicationID>"
    var.tenants:
     - id: "<MyTenantID>"
       name: "mytenant.onmicrosoft.com"
    var.client_secret: "<YourClientSecretHere>"

output.console:
  enabled: true
EOF
$ ./filebeat -c ./filebeat-test-module.yml -e
```<hr>This is an automatic backport of pull request #44909 done by [Mergify](https://mergify.com).