elastic / elastic/integrations
[Azure Frontdoor]: Azure Frontdoor Logs are missing the azure.subscription_id and azure.resource_id field
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Azure Frontdoor [packages/azure_frontdoor]
### Dataset Name
azure.frontdoor_*
### Integration Version
2.5.0
### Agent Version
9.4.4
### OS Version and Architecture
Ubuntu 20.04
### User Goal
The goal is to have a uniformed schema for Azure Logs. Especially the field azure.subscription_id iscrucial (in our case) to distinguish the data coming from different subscriptions and thus tenants.
As of now, the data is written in the field:
```json
"azure": {
"frontdoor": {
....
"resource_id": "/SUBSCRIPTIONS//RESOURCEGROUPS//PROVIDERS/MICROSOFT.CDN/PROFILES/",
"category": "FrontDoorHealthProbeLog"
}},
```
### Existing Features
Currently, the data is stored in azure.frontdoor.resource_id
### What did you see?
The workaround is to use a custom pipeline called logs-azure_frontdoor.integration@custom. Example logic:
```yaml
processors:
- set:
field: azure.resource_id
copy_from: azure.frontdoor.resource_id
ignore_failure: true
- grok:
field: azure.resource_id
patterns:
- >-
/SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/%{PROVIDERNAME:azure.resource.name}
pattern_definitions:
SUBID: >-
(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}
GROUPID: .+
PROVIDERNAME: .+
NAMESPACE: .+
RULE: .+
ignore_failure: true
```
### Anything else?
Related issues:
- https://github.com/elastic/integrations/issues/11172
Contributor guide
Assessment
This issue has not been assessed yet.