[Azure] Add support for activity logs from Azure Monitor
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
## Situation
Activity logs are a log category supported by almost all Azure services. For example, we can collect activity logs from:
- Storage Account
- Event Hubs
- Subscriptions
- and, of course, Azure Monitor and many more.
Activity Logs should have the same format in all services.
## Problem
However, it seems that the activity logs from Azure Monitor have a subtle difference: the level from Monitor is a string as in "Informative" instead of a numeric code, like `4`.
The current Filebeat module supports the activity log version, where the level is a numeric number.
I never tested activity logs from Azure Monitor, but I set up a diagnostic setting to see what's coming from it.
Here's what I got in our test account:

## Solution
Possible approaches:
- Rename the level as a string with a different name (for example, `.level_name` with the `keyword` mapping)
- Map the string version to the numeric code
I'm open to a better solution.
We need to investigate what's better.
Contributor guide
Research direction
Start by inspecting the existing Filebeat Azure activity-log module and compare its numeric level handling with the Azure Monitor sample in the issue. Decide on a compatible mapping or field representation, then validate ingestion for both numeric and string levels; done means Azure Monitor activity logs are handled without breaking existing activity-log support.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, observability-sre
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100