Azure Activity Logs

Pull Activity logs from Azure to Logstash

In Microsoft Azure the Activity Log is a platform that provides insights into subscription level events, including auditable details of when a resource is modified or when a container is started. By configuring the required activity logs to forward to Event Hub we can then pull them into the Logit.io ELK Stack via Logstash.

Install Integration

Please click on the Install Integration button to configure your stack for this source.

Ensure Azure Event Hub

Before you begin you will need to ensure you have an available Azure Event Hub in the Azure Portal (opens in a new tab).

You should create a diagnostic setting to send the Activity logs (opens in a new tab) to this Event Hub.

View your Azure event hub

Once you have configured your Event Hub we now need to confirm messages are arriving.

Confirm Messages in Event Hub

In your Azure Portal browse to your Event Hub, from the dashboard you should be able to see messages arriving.

Ensure there is recent activity on the graph and the incoming requests isn't zero.

Graphs showing that messages are arriving

Configure Permissions

Once you have data streaming to your Azure event hub, it is recommended to create a Consumer Group specifically for Logstash and not to reuse any default or existing groups.

The Logstash input supports multiple event hubs - the connection string for each hub can be found in the Azure Portal (opens in a new tab) -> Event Hub -> Shared access policies.

example connection string
Endpoint=sb://<youreventhubnamespace>.servicebus.windows.net/;SharedAccessKeyName=<yoursharedaccesspolicyname>;SharedAccessKey=<yoursharedaccesskey>;EntityPath=<youreventhubname>

A blob storage account is used to preserve state across Logstash reboots. The Storage account connection string can be found in the Access Keys section under the Storage Account Settings menu in the Azure Portal (opens in a new tab)

example connection string
 
DefaultEndpointsProtocol=https;AccountName=<storage-account-name>;
AccountKey=<storage-account-key>;
EndpointSuffix=core.windows.net

Configure Logstash For Azure Event Hub

To start pulling logs and metrics from the Azure Event Hub to your Stack you need to configure an Azure Logstash Input on your Logit.io Stack.

Go to Dashboard

Logit.io will verify your input before it is applied, we will contact you to confirm when this has been completed.

Check Logit.io for your logs

Data should now have been sent to your Stack.

View My Data

If you don't see take a look at How to diagnose no data in Stack below for how to diagnose common issues.

How to diagnose no data in Stack

If you don't see data appearing in your stack after following this integration, take a look at the troubleshooting guide for steps to diagnose and resolve the problem or contact our support team and we'll be happy to assist.

Active Directory Azure Eventhub Diagnostic Logs