fluent-plugin-azuremonitorlog's Introduction

fluent-plugin-azuremonitorlog, a plugin for Fluentd

Overview

This plugin gets the monitor activity logs from Azure Monitor API to fluentd.

Installation

To use this plugin, you need to have Azure Service Principal.
Create an Azure Service Principal through Azure CLI or Azure portal.

Install plugin from RubyGems:

$ gem install fluent-plugin-azuremonitorlog

Configuration

<source>
  @type azuremonitorlog
  tag azuremonitorlog
  tenant_id [Azure_Tenant_ID]
  subscription_id [Azure_Subscription_Id]
  client_id [Azure_Client_Id]
  client_secret [Azure_Client_Secret]
  
  select [selected fields to query]
  filter [filter the query query] (default: eventChannels eq 'Admin, Operation')
  interval [interval in seconds] (default: 300)
  api_version [api version] (default: 2015-04-01)
</source>

Documentation for select and filter can be found here

Example for source config

<source>
    @type azuremonitorlog
    tag azuremonitorlog
    tenant_id [Azure_Tenant_ID]
    subscription_id [Azure_Subscription_Id]
    client_id [Azure_Client_Id]
    client_secret [Azure_Client_Secret]
    select_filter eventName,id,resourceGroupName,resourceProviderName,operationName,status,eventTimestamp,correlationId,submissionTimestamp,level
</source>

Start fluentd:

$ fluentd -c ./fluentd.conf

output example:

{
	"correlationId": "00000000-0000-0000-0000-000000000000",
	"eventName": {
		"value": "EndRequest",
		"localizedValue": "End request"
	},
	"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myresourcegroup/events/00000000-0000-0000-0000-000000000000/ticks/636444295616045190",
	"resourceGroupName": "myresourcegroup",
	"resourceProviderName": {
		"value": "Microsoft.Resources",
		"localizedValue": "Microsoft Resources"
	},
	"operationName": {
		"value": "Microsoft.Resources/subscriptions/resourcegroups/write",
		"localizedValue": "Update resource group"
	},
	"status": {
		"value": "Succeeded",
		"localizedValue": "Succeeded"
	},
	"eventTimestamp": "2017-10-24T08:12:41.604519Z"
}