elastic / elastic/integrations

[Azure Logs]: Azure Blob Storage Endpoint in Elastic Agent Azure Integration for Sovereign/DoD Clouds (IL6) is incorrect

Open
#16,646 0 comments 0 reactions 0 assignees View on GitHub
Integration:azure needs:triage Team:obs-ds-hosted-services
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Azure Logs [azure]

### Dataset Name

azure.*

### Integration Version

1.28.7

### Agent Version

9.1.4

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.1.4

### OS Version and Architecture

Windows and Linux

### Software/API Version

_No response_

### Error Message

Github.com/Azure/azure-pipeline-go/pipeline.NewError, [github.com/Azure/azure-pipeline-go@v0.2.3/pieline/error.go:157](mailto:github.com/Azure/azure-pipeline-go@v0.2.3/pieline/error.go:157) HTTP request failed Get “https://.blob.azure.microsft.scloud/filebeat-auditlogs-entraid? restype=container=61”: dial tcp: lookup .blob.azure.microsft.scloud on : no such host.

### Event Original

N/A

### What did you do?

When configuring the Azure Logs (v1) integration the following configuration is applied:

Integration Name: azure-logs-entraid
Description: "Collect azure logs"
Event Hub Name: "azure-logs-entraid"
Consumer Group: "read"
Connection String: specified from Primary Connection String from Shared Access Key policy with Listen Claim of specific event hub entitity
Storage Account:
Resource Manager: https://management.azure.microsoft.scloud
Collect Microsoft Entra ID Logs (v1): enabled

### What did you see?

Current Behavior:
The integration only allows configuration of the Resource Manager endpoint.
The blob endpoint is not configurable and is incorrectly derived for IL6, using .blob.azure.microsoft.scloud. This URL is incorrect and results in the error message.

### What did you expect to see?

Expected Behavior:
The integration should correctly derive the blob endpoint for IL6. The storage account reports the correct URL for IL6 is .blob.core.microsoft.scloud, and the integration should use this value instead.

### Anything else?

I do see the v2 Preview of Collect All Azure Logs (v2 preview) does have an Advanced Option for Storage Account Endpoint Suffix, but when we specify core.microsoft.scloud, the integration will only go green when if the Resource Manager is cleared out, and still wont pull events from the event hub.

In addition to this Bug report, i created a similar Feature Enhancement at https://github.com/elastic/integrations/issues/16644. Assuming that v2 of this integration gets pushed, I believe the Feature Enhancement could be considered addressed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.