Azure Data Explorer
Send logs to Azure Data Explorer (Kusto)
You can create an Azure Data Explorer cluster in one of the following ways:
Fluent-Bit will use the application's credentials, to ingest data into your cluster.
Fluent-Bit ingests the event data into Kusto in a JSON format, that by default will include 3 properties:
log- the actual event payload.
tag- the event tag.
timestamp- the event timestamp.
A table with the expected schema must exist in order for data to be ingested properly.
.create table FluentBit (log:dynamic, tag:string, timestamp:datetime)
By default, Kusto will insert incoming ingestions into a table by inferring the mapped table columns, from the payload properties. However, this mapping can be customized by creatng a JSON ingestion mapping. The plugin can be configured to use an ingestion mapping via the
Get started quickly with this configuration file:
If you get a
403 Forbiddenerror response, make sure that:
- You provided the correct AAD registered application credentials.
- You authorized the application to ingest into your database or table.