elastic / elastic/integrations
[Azure Logs]: Azure Blob Storage Endpoint in Elastic Agent Azure Integration for Sovereign/DoD Clouds (IL6) is incorrect
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Azure Logs [azure]
### Dataset Name
azure.*
### Integration Version
1.28.7
### Agent Version
9.1.4
### Agent Output Type
elasticsearch
### Elasticsearch Version
9.1.4
### OS Version and Architecture
Windows and Linux
### Software/API Version
_No response_
### Error Message
Github.com/Azure/azure-pipeline-go/pipeline.NewError, [github.com/Azure/azure-pipeline-go@v0.2.3/pieline/error.go:157](mailto:github.com/Azure/azure-pipeline-go@v0.2.3/pieline/error.go:157) HTTP request failed Get “https://.blob.azure.microsft.scloud/filebeat-auditlogs-entraid? restype=container=61”: dial tcp: lookup .blob.azure.microsft.scloud on : no such host.
### Event Original
N/A
### What did you do?
When configuring the Azure Logs (v1) integration the following configuration is applied:
Integration Name: azure-logs-entraid
Description: "Collect azure logs"
Event Hub Name: "azure-logs-entraid"
Consumer Group: "read"
Connection String: specified from Primary Connection String from Shared Access Key policy with Listen Claim of specific event hub entitity
Storage Account:
Resource Manager: https://management.azure.microsoft.scloud
Collect Microsoft Entra ID Logs (v1): enabled
### What did you see?
Current Behavior:
The integration only allows configuration of the Resource Manager endpoint.
The blob endpoint is not configurable and is incorrectly derived for IL6, using .blob.azure.microsoft.scloud. This URL is incorrect and results in the error message.
### What did you expect to see?
Expected Behavior:
The integration should correctly derive the blob endpoint for IL6. The storage account reports the correct URL for IL6 is .blob.core.microsoft.scloud, and the integration should use this value instead.
### Anything else?
I do see the v2 Preview of Collect All Azure Logs (v2 preview) does have an Advanced Option for Storage Account Endpoint Suffix, but when we specify core.microsoft.scloud, the integration will only go green when if the Resource Manager is cleared out, and still wont pull events from the event hub.
In addition to this Bug report, i created a similar Feature Enhancement at https://github.com/elastic/integrations/issues/16644. Assuming that v2 of this integration gets pushed, I believe the Feature Enhancement could be considered addressed.
Contributor guide
Assessment
This issue has not been assessed yet.