From 7be3851f3e3dc46653667659108cafaef96eb1b4 Mon Sep 17 00:00:00 2001
From: Marc Guasch <marc.guasch@elastic.co>
Date: Fri, 12 Feb 2021 10:43:48 +0100
Subject: [PATCH] Fix okta default date in module config

---
 CHANGELOG.next.asciidoc                             | 1 +
 x-pack/filebeat/module/okta/system/config/input.yml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 3a6f59df63c..cdfce9ba5aa 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -378,6 +378,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix handling of ModifiedProperties field in Office 365. {pull}23777[23777]
 - Use rfc6587 framing for fortinet firewall and clientendpoint filesets when transferring over tcp. {pull}23837[23837]
 - Fix httpjson input logging so it doesn't conflict with ECS. {pull}23972[23972]
+- Fix Okta default date formatting. {issue}24018[24018] {pull}24025[24025]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/module/okta/system/config/input.yml b/x-pack/filebeat/module/okta/system/config/input.yml
index 107dd3ca320..be1634d73ae 100644
--- a/x-pack/filebeat/module/okta/system/config/input.yml
+++ b/x-pack/filebeat/module/okta/system/config/input.yml
@@ -25,7 +25,7 @@ request.transforms:
   - set:
       target: url.params.since
       value: "[[.cursor.published]]"
-      default: '[[now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}")) "RFC3339"]]'
 
 response.pagination:
   - set: