fluent-plugin-azuremonitorlog, a plugin for Fluentd
Overview
Azure Monitor log input plugin.
This plugin gets the monitor activity logs from Azure Monitor API to fluentd.
Installation
To use this plugin, you need to have Azure Service Principal.
Create an Azure Service Principal through Azure CLI or Azure portal.
Install plugin from RubyGems:
$ gem install fluent-plugin-azuremonitorlog
Configuration
<source>
@type azuremonitorlog
tag azuremonitorlog
tenant_id [Azure_Tenant_ID]
subscription_id [Azure_Subscription_Id]
client_id [Azure_Client_Id]
client_secret [Azure_Client_Secret]
select [selected fields to query]
filter [filter the query query] (default: eventChannels eq 'Admin, Operation')
interval [interval in seconds] (default: 300)
api_version [api version] (default: 2015-04-01)
</source>
Documentation for select and filter can be found here
Example for source config
<source>
@type azuremonitorlog
tag azuremonitorlog
tenant_id [Azure_Tenant_ID]
subscription_id [Azure_Subscription_Id]
client_id [Azure_Client_Id]
client_secret [Azure_Client_Secret]
select_filter eventName,id,resourceGroupName,resourceProviderName,operationName,status,eventTimestamp,correlationId,submissionTimestamp,level
</source>
Start fluentd:
$ fluentd -c ./fluentd.conf
output example:
{
"correlationId": "00000000-0000-0000-0000-000000000000",
"eventName": {
"value": "EndRequest",
"localizedValue": "End request"
},
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myresourcegroup/events/00000000-0000-0000-0000-000000000000/ticks/636444295616045190",
"resourceGroupName": "myresourcegroup",
"resourceProviderName": {
"value": "Microsoft.Resources",
"localizedValue": "Microsoft Resources"
},
"operationName": {
"value": "Microsoft.Resources/subscriptions/resourcegroups/write",
"localizedValue": "Update resource group"
},
"status": {
"value": "Succeeded",
"localizedValue": "Succeeded"
},
"eventTimestamp": "2017-10-24T08:12:41.604519Z"
}
Test
Run tests:
$ rake test
Contributing
- Fork it
- Create your feature branch (
git checkout -b my-new-feature
) - Commit your changes (
git commit -am 'Added some feature'
) - Push to the branch (
git push origin my-new-feature
) - Create new Pull Request