fluent-plugin-azuremonitorlog, a plugin for Fluentd
Azure Monitor log input plugin.
This plugin gets the monitor activity logs from Azure Monitor API to fluentd.
To use this plugin, you need to have Azure Service Principal.
Create an Azure Service Principal through Azure CLI or Azure portal.
Install plugin from RubyGems:
$ gem install fluent-plugin-azuremonitorlog
<source>
@type azuremonitorlog
tag azuremonitorlog
tenant_id [Azure_Tenant_ID]
subscription_id [Azure_Subscription_Id]
client_id [Azure_Client_Id]
client_secret [Azure_Client_Secret]
select [selected fields to query]
filter [filter the query query] (default: eventChannels eq 'Admin, Operation')
interval [interval in seconds] (default: 300)
api_version [api version] (default: 2015-04-01)
</source>
Documentation for select and filter can be found here
<source>
@type azuremonitorlog
tag azuremonitorlog
tenant_id [Azure_Tenant_ID]
subscription_id [Azure_Subscription_Id]
client_id [Azure_Client_Id]
client_secret [Azure_Client_Secret]
select_filter eventName,id,resourceGroupName,resourceProviderName,operationName,status,eventTimestamp,correlationId,submissionTimestamp,level
</source>
Start fluentd:
$ fluentd -c ./fluentd.conf
output example:
{
"correlationId": "00000000-0000-0000-0000-000000000000",
"eventName": {
"value": "EndRequest",
"localizedValue": "End request"
},
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myresourcegroup/events/00000000-0000-0000-0000-000000000000/ticks/636444295616045190",
"resourceGroupName": "myresourcegroup",
"resourceProviderName": {
"value": "Microsoft.Resources",
"localizedValue": "Microsoft Resources"
},
"operationName": {
"value": "Microsoft.Resources/subscriptions/resourcegroups/write",
"localizedValue": "Update resource group"
},
"status": {
"value": "Succeeded",
"localizedValue": "Succeeded"
},
"eventTimestamp": "2017-10-24T08:12:41.604519Z"
}
Run tests:
$ rake test
- Fork it
- Create your feature branch (
git checkout -b my-new-feature
) - Commit your changes (
git commit -am 'Added some feature'
) - Push to the branch (
git push origin my-new-feature
) - Create new Pull Request