elastic / elastic/beats

[Azure] Add support for activity logs from Azure Monitor

Open
#42,680 4 comments 0 reactions 0 assignees View on GitHub
bug enhancement input:azure-monitor Stalled Team:obs-ds-hosted-services
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

## Situation

Activity logs are a log category supported by almost all Azure services. For example, we can collect activity logs from:

- Storage Account
- Event Hubs
- Subscriptions
- and, of course, Azure Monitor and many more.

Activity Logs should have the same format in all services.

## Problem

However, it seems that the activity logs from Azure Monitor have a subtle difference: the level from Monitor is a string as in "Informative" instead of a numeric code, like `4`.

The current Filebeat module supports the activity log version, where the level is a numeric number.

I never tested activity logs from Azure Monitor, but I set up a diagnostic setting to see what's coming from it.

Here's what I got in our test account:

![Image](https://github.com/user-attachments/assets/2f8c2517-e267-49ef-b566-450e320d9790)

## Solution

Possible approaches:

- Rename the level as a string with a different name (for example, `.level_name` with the `keyword` mapping)
- Map the string version to the numeric code

I'm open to a better solution.

We need to investigate what's better.

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the existing Filebeat Azure activity-log module and compare its numeric level handling with the Azure Monitor sample in the issue. Decide on a compatible mapping or field representation, then validate ingestion for both numeric and string levels; done means Azure Monitor activity logs are handled without breaking existing activity-log support.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.