The httpjson input template irrationally/unnecessarily attempts to use parseDuration with no arguments, which filebeat does not accept.

e.g. template snippet,

cursor:
  last_execution_datetime:
    value: '[[(formatDate (now (parseDuration)) "RFC3339")]]'

Error,

This means that the request.transforms reference to the cursor will fail, and the default value which applies the parseDuration minus {{initial_interval}} gets used.

Hence the integration continually requests historic logs and never really updates the cursor to only request logs from the last time it ran. e.g.

request.transforms:
  - set:
      target: url.params.$filter
      value: StartDate eq datetime'[[.cursor.last_execution_datetime]]' and EndDate eq datetime'[[(formatDate (now) "RFC3339")]]'
      default: StartDate eq datetime'[[(formatDate (now (parseDuration "-{{initial_interval}}")) "RFC3339")]]' and EndDate eq datetime'[[(formatDate (now) "RFC3339")]]'

PR inbound shortly.