elastic / elastic/integrations

[azure_metrics]: monitor metricset: single unsupported resource type in resource group degrades entire unit, blocking collection for correctly-configured resource types

Open
#20,848 0 comments 0 reactions 0 assignees View on GitHub
needs:triage
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

Azure Resource Metrics [packages/azure_metrics]

### Dataset Name

_No response_

### Integration Version

1.14.0

### Agent Version

9.4.4

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.4.4

### OS Version and Architecture

Architecture: x86_64, Red Hat Enterprise Linux (running in AKS as a `hostNetwork` DaemonSet)

### Software/API Version

_No response_

### Error Message

{"log.level":"warn","message":"Unit state changed azure/metrics-default-azure/metrics-monitor- (HEALTHY->DEGRADED): Recoverable: Error fetching data for metricset azure.monitor: GET https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Insights/activityLogAlerts//providers/Microsoft.Insights/metricDefinitions\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: BadRequest\n--------------------------------------------------------------------------------\n{\n \"code\": \"BadRequest\",\n \"message\": \"Microsoft.Insights/activityLogAlerts is not a supported platform metric namespace, supported ones are Microsoft.AppPlatform/Spring,...,Microsoft.KeyVault/vaults,...,Microsoft.Web/sites,... [full supported list truncated for brevity]\"\n}"}

### Event Original

_No response_

### What did you do?

Configured the monitor-azure/metrics input's azure.monitor stream with a resources YAML explicitly listing 27 valid, metric-capable resource_type values (e.g. microsoft.keyvault/vaults, microsoft.web/sites, microsoft.network/applicationgateways, microsoft.network/expressroutecircuits, etc.), each with metrics: [{name: ["*"]}], deployed via the standard Fleet integration policy. The target resource groups in scope also contain typical companion monitoring/alerting resources (Action Groups, Workbooks, Activity Log Alerts) alongside the intended monitored resources.

### What did you see?

The metrics-azure.monitor-* index contains only error documents referencing unsupported resource types (Action Groups, Workbooks, Activity Log Alerts) — zero successful metric documents exist for any of the 27 explicitly-configured resource_type entries, despite the live Fleet policy configuration being verified to exactly match intent. A single 400 BadRequest from an unsupported/incompatible resource type degrades the entire azure/metrics-monitor unit (HEALTHY → DEGRADED).
Other azure/metrics policy templates (compute_vm, storage_account, database_account) in the same integration policy, using identical client_id/client_secret/tenant_id credentials, successfully collect metrics.

### What did you expect to see?

The monitor metricset should skip/log a warning for any discovered resource whose type doesn't support Azure Monitor platform metrics, and continue successfully collecting metrics for the remaining, correctly-configured resource types in the same cycle — not degrade the entire unit and block collection for all configured types.

### Anything else?

It appears the monitor metricset's resource discovery is not strictly limited to the configured resource_type list — it also encounters unrelated resources within the same resource group scope (Action Groups, Workbooks, Activity Log Alerts), which are extremely common companion resources in any production monitoring/alerting setup. This makes the bug likely to affect a large proportion of real-world monitor stream deployments, not just this specific configuration.

Contributor guide

Open the contributing guide

Research direction

Start in packages/azure_metrics, focusing on the monitor-azure/metrics input and its azure.monitor stream. Reproduce with a resources YAML containing valid metric-capable types alongside Action Groups, Workbooks, or Activity Log Alerts; done means unsupported resources are skipped or warned about while valid resource types continue producing metric documents without degrading the unit.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, observability-sre
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.