o365: Additional context around the max_retention (#19037)

I think it would be good to get some extra information around the max_retention setting, to make it clear that unless the tenant itself has a longer retention period, then 7 days is going to be all that you can fetch. Follow-on from investigation behind #18948
elastic · Jun 9, 2020 · 05935ee · 05935ee
1 parent d7d5634
commit 05935ee
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/filebeat/docs/modules/o365.asciidoc b/filebeat/docs/modules/o365.asciidoc
@@ -189,7 +189,8 @@ endpoints.
 
 The maximum data retention period to support. `168h` by default. {beatname_uc}
 will fetch all retained data for a tenant when run for the first time. The
-default is 7 days. Adjust it if your tenant has a different retention period.
+default is 7 days, which matches the standard period that Microsoft will keep the
+logs before deleting them. Only increase it if your tenant has a longer retention period.
 
 *`var.api.poll_interval`*::
 

diff --git a/x-pack/filebeat/module/o365/_meta/docs.asciidoc b/x-pack/filebeat/module/o365/_meta/docs.asciidoc
@@ -184,7 +184,8 @@ endpoints.
 
 The maximum data retention period to support. `168h` by default. {beatname_uc}
 will fetch all retained data for a tenant when run for the first time. The
-default is 7 days. Adjust it if your tenant has a different retention period.
+default is 7 days, which matches the standard period that Microsoft will keep the
+logs before deleting them. Only increase it if your tenant has a longer retention period.
 
 *`var.api.poll_interval`*::