Azure Log Analytics

Send logs, metrics to Azure Log Analytics

The Azure output plugin lets you ingest your records into Azure Log Analytics service.

For details about how to setup Azure Log Analytics, see the Azure Log Analytics documentation.

Configuration parameters

Key	Description	Default
Customer_ID	Customer ID or WorkspaceID string.	none
Shared_Key	The primary or the secondary Connected Sources client authentication key.	none
Log_Type	The name of the event type.	fluentbit
Log_Type_Key	If included, the value for this key checked in the record and if present, will overwrite the log_type. If not found then the log_type value will be used.	none
Time_Key	Optional. Specify the key name where the timestamp will be stored.	@timestamp
Time_Generated	If enabled, the HTTP request header time-generated-field will be included so Azure can override the timestamp with the key specified by time_key option.	off
Workers	The number of workers to perform flush operations for this output.	0

Get started

To insert records into an Azure Log Analytics instance, run the plugin from the command line or through the configuration file.

Command line

The Azure plugin can read the parameters from the command line in the following ways, using the -p argument (property):

fluent-bit -i cpu -o azure -p customer_id=abc -p shared_key=def -m '*' -f 1

Configuration file

In your main configuration file append the following sections:

fluent-bit.yaml

pipeline:
  inputs:
    - name: cpu

  outputs:
    - name: azure
      match: '*'
      customer_id: abc
      shared_key: def

fluent-bit.conf

[INPUT]
  Name  cpu

[OUTPUT]
  Name        azure
  Match       *
  Customer_ID abc
  Shared_Key  def

The following example uses the Log_Type_Key with record-accessor, which will read the table name (or event type) dynamically from the Kubernetes label app, instead of Log_Type:

fluent-bit.yaml

pipeline:
  inputs:
    - name: cpu

  outputs:
    - name: azure
      match: '*'
      log_type_key: $kubernetes['labels']['app']
      customer_id: abc
      shared_key: def

fluent-bit.conf

[INPUT]
  Name  cpu

[OUTPUT]
  Name        azure
  Match       *
  Log_Type_Key $kubernetes['labels']['app']
  Customer_ID abc
  Shared_Key  def