Send logs to Azure Monitor
Create a stream that sends the logs of your applications to an Azure Monitor workspace, in Azion Console or with the Azion API, and confirm the delivery.
You can send the logs of a stream to an Azure Monitor workspace from Azion Console or with the Azion API. To write the logs as files in an Azure storage container instead, refer to Send logs to Azure Blob Storage.
Data Stream sends each batch of log lines to the workspace, which stores them in the table that Log Type names. In the stream form, the endpoint is set in the field labeled Connector, and the Azure Monitor option selects this endpoint. For every field and its bounds, refer to Endpoints.
The example collects the requests of one workload with the Applications data source.
Prerequisites
Console
- An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
- A workload on the account that receives requests.
- An Azure account with a Log Analytics workspace, added to Microsoft Sentinel.
- The Workspace ID and the Primary Key of the workspace. The workspace shows both under Agents Management. The Primary Key is the credential of the stream.
- Access to Azion Console. To sign in, refer to How to access Azion Console.
Create the stream
The stream collects from the workload you choose, through a workload filter. A workload filter keeps your other streams active, which sampling does not.
Console
To create the stream in Azion Console:
Access Azion Console > Data Stream.
In the General section, enter a Name. For example: logs-to-azure-monitor.
In the Input section, select Applications in Data Source.
In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.
In the Transform section, set Option to Filter Workloads. In Available Workload, select your workload and move it to Chosen Workload with the arrow. If your Console names domains where this guide names workloads, the same control reads Filter Domains. The pick list then reads Available Domain and Chosen Domain.
In the Render Template section, select Applications Event Collector in Template.
In the Output section, select Azure Monitor in Connector.
In Log Type, enter the name of the table that stores the logs. For example: AzionLogs. Use only letters, numbers, and the underscore _, up to 100 characters.
Enter the Primary Key of the workspace in Shared Key and its ID in Workspace ID. The Console masks Shared Key.
In Time Generated Field, enter a value such as myCustomTimeField. Leave it empty to use the ingestion time.
In the Status section, keep Active turned on.
The Console shows Your data stream has been created. The stream appears in the Data Stream list with Azure Monitor in the Connector column and the Active status.
The API and the Console save the stream without contacting the workspace. A wrong workspace ID or key surfaces only when the stream sends. An activation takes effect after one to two minutes.
Confirm the delivery
Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload, then wait about a minute: a stream sends a batch every 60 seconds, or sooner when it reaches 2,000 log lines.
Console
To find the sends in Azion Console:
Access Azion Console > Real-Time Events.
Each row is one send. Find the rows with AZURE_MONITOR in Endpoint Type, and read their Status Code.
A Status Code of 200 means the workspace accepted the batch. Streamed Lines gives the number of log lines in the batch.
A status other than 200 is the answer of the endpoint, and 503 means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.
In Azure, open the Logs section of the workspace and query the table that Log Type names. Its records are the log lines of the stream.