elastic / elastic/beats

[filebeat][salesforce] EventLogFile collection fails with INVALID_SESSION_ID and does not re-authenticate

Open
#51,589 3 comments 0 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

**Version**: 9.3.3

**Operating System**: RHEL 9.7 (containerized)

## Description

The Salesforce input fails during EventLogFile collection when the session token expires. Instead of re-authenticating, the input logs an error and halts the collection cycle. On the next scheduled interval it appears to encounter the same issue, suggesting the session is not being refreshed.

## Steps to Reproduce

Configure the Salesforce input for EventLogFile collection with an hourly interval
Allow the input to run long enough for the Salesforce session token to expire
Observe the error in filebeat logs

## Observed behavior
```
{"log.level":"error","message":"Problem running EventLogFile collection: insert response err: INVALID_SESSION_ID: Session expired or invalid","log.origin":{"file.line":191,"file.name":"salesforce/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/salesforce.(*salesforceInput).run"}}
{"log.level":"info","message":"Running EventLogFile collection","log.origin":{"file.line":188,"file.name":"salesforce/input.go"}}
{"log.level":"info","message":"Running EventLogFile collection with interval: 1h0m0s","log.origin":{"file.line":330,"file.name":"salesforce/input.go"}}
{"log.level":"info","message":"Query formed: SELECT CreatedDate,LogDate,LogFile FROM EventLogFile WHERE Interval = 'Hourly' AND EventType = 'Logout' AND CreatedDate > 2026-06-13T05:58:12.000+0000 ORDER BY LogDate ASC NULLS FIRST","log.origin":{"file.line":349,"file.name":"salesforce/input.go"}}
{"log.level":"error","message":"Problem running EventLogFile collection: insert response err: INVALID_SESSION_ID: Session expired or invalid","log.origin":{"file.line":191,"file.name":"salesforce/input.go"}}
```

## Expected behavior
When a session expiration error is received, the input should attempt to re-authenticate (refresh the token) and retry the collection rather than failing the cycle.

Contributor guide

Open the contributing guide

Research direction

Start in x-pack/filebeat/input/salesforce/input.go, especially the run path and EventLogFile collection around the logged lines 188-191 and 330-349. Trace how INVALID_SESSION_ID is handled and verify that expiration causes re-authentication and a retry, with the collection cycle completing instead of halting.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.