[Filebeat][O365 Module] client_secret produces error if secret starts with @

[P1llus]

Seems like there might be an issue with the configuration mapping (mustache?) for certain fields starting with @.

Looking at: https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778

The following example:

- module: o365
  audit:
    enabled: true
    var.application_id: "xxx"
    var.tenants:
      - id: "xxx"
        name: "xxx"
    var.client_secret: "@/xxx"

Would produce an error like:
cfgfile/list.go:99 Error creating runner from config: Error getting config for fileset o365/audit: Error reading input config: yaml: line 12: found character that cannot start any token.

Will update this issue once I have looked into it.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

The issue is that within the generated configuration (the rendered config template) the password is missing single quotes.

beats/x-pack/filebeat/module/o365/audit/config/input.yml

Line 12 in 83f248e

{{ if .client_secret }}client_secret: {{ .client_secret }}{{ end }}