[filebeat][salesforce] EventLogFile collection fails with INVALID_SESSION_ID and does not re-authenticate
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
**Version**: 9.3.3
**Operating System**: RHEL 9.7 (containerized)
## Description
The Salesforce input fails during EventLogFile collection when the session token expires. Instead of re-authenticating, the input logs an error and halts the collection cycle. On the next scheduled interval it appears to encounter the same issue, suggesting the session is not being refreshed.
## Steps to Reproduce
Configure the Salesforce input for EventLogFile collection with an hourly interval
Allow the input to run long enough for the Salesforce session token to expire
Observe the error in filebeat logs
## Observed behavior
```
{"log.level":"error","message":"Problem running EventLogFile collection: insert response err: INVALID_SESSION_ID: Session expired or invalid","log.origin":{"file.line":191,"file.name":"salesforce/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/salesforce.(*salesforceInput).run"}}
{"log.level":"info","message":"Running EventLogFile collection","log.origin":{"file.line":188,"file.name":"salesforce/input.go"}}
{"log.level":"info","message":"Running EventLogFile collection with interval: 1h0m0s","log.origin":{"file.line":330,"file.name":"salesforce/input.go"}}
{"log.level":"info","message":"Query formed: SELECT CreatedDate,LogDate,LogFile FROM EventLogFile WHERE Interval = 'Hourly' AND EventType = 'Logout' AND CreatedDate > 2026-06-13T05:58:12.000+0000 ORDER BY LogDate ASC NULLS FIRST","log.origin":{"file.line":349,"file.name":"salesforce/input.go"}}
{"log.level":"error","message":"Problem running EventLogFile collection: insert response err: INVALID_SESSION_ID: Session expired or invalid","log.origin":{"file.line":191,"file.name":"salesforce/input.go"}}
```
## Expected behavior
When a session expiration error is received, the input should attempt to re-authenticate (refresh the token) and retry the collection rather than failing the cycle.
Contributor guide
Research direction
Start in x-pack/filebeat/input/salesforce/input.go, especially the run path and EventLogFile collection around the logged lines 188-191 and 330-349. Trace how INVALID_SESSION_ID is handled and verify that expiration causes re-authentication and a retry, with the collection cycle completing instead of halting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100