Skip to content

Commit 3a6691a

Browse files
giorgi-imerlishvili-elasticgiorgi-imerlishvili-elastic
authored
[Azure App Service] Update Readme (#15784)
Update readme
1 parent 601fa61 commit 3a6691a

File tree

5 files changed

+117
-73
lines changed

5 files changed

+117
-73
lines changed

‎packages/azure_app_service/_dev/build/docs/README.md‎

Lines changed: 5 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -16,44 +16,13 @@ This integration currently collects one data stream:
1616

1717
- App Service Logs
1818

19-
## Requirements
20-
21-
### Credentials
22-
23-
`eventhub` :
24-
_string_
25-
Is the fully managed, real-time data ingestion service.
26-
27-
`consumer_group` :
28-
_string_
29-
The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets.
30-
Default value: `$Default`
31-
32-
`connection_string` :
33-
_string_
34-
The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string.
35-
36-
A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages.
37-
38-
`storage_account` :
39-
_string_
40-
The name of the storage account the state/offsets will be stored and updated.
41-
42-
`storage_account_key` :
43-
_string_
44-
The storage account key, this key will be used to authorize access to data in your storage account.
45-
46-
`resource_manager_endpoint` :
47-
_string_
48-
Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment.
49-
Ex:
50-
https://management.chinacloudapi.cn/ for azure ChinaCloud
51-
https://management.microsoftazure.de/ for azure GermanCloud
52-
https://management.azure.com/ for azure PublicCloud
53-
https://management.usgovcloudapi.net/ for azure USGovernmentCloud
54-
Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints.
19+
## Requirements and setup
20+
Refer to the [Azure Logs](https://docs.elastic.co/integrations/azure) page for more information on how to set up and use this integration.
5521

5622
## App Service Logs
23+
Collects different types of logs from Azure App Service via Event Hub.
24+
25+
{{event "app_service_logs"}}
5726

5827
**ECS Field Reference**
5928

‎packages/azure_app_service/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.9.0"
3+
changes:
4+
- description: Update readme
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15784
27
- version: "0.8.0"
38
changes:
49
- description: Add dashboard for log categories Application Logs, Audit Logs, Console Logs, HTTP Logs, IPsec Audit Logs and Platform Logs.

‎packages/azure_app_service/data_stream/app_service_logs/sample_event.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"agent": {
3+
"name": "EPGETBIW05AD",
4+
"id": "e42ad9e7-fc37-4342-80cc-ee5bcb314f5d",
5+
"ephemeral_id": "65e0aae6-d877-4830-b9f0-10b0ccd39bb9",
6+
"type": "filebeat",
7+
"version": "8.18.3"
8+
},
9+
"@timestamp": "2025-10-28T09:39:57.805Z",
10+
"ecs": {
11+
"version": "8.11.0"
12+
},
13+
"data_stream": {
14+
"namespace": "default",
15+
"type": "logs",
16+
"dataset": "azure_app_service.app_service_logs"
17+
},
18+
"elastic_agent": {
19+
"id": "e42ad9e7-fc37-4342-80cc-ee5bcb314f5d",
20+
"version": "8.18.3",
21+
"snapshot": false
22+
},
23+
"event": {
24+
"agent_id_status": "verified",
25+
"ingested": "2025-10-28T09:40:37Z",
26+
"dataset": "azure_app_service.app_service_logs"
27+
},
28+
"tags": [
29+
"azure-appservice",
30+
"forwarded"
31+
],
32+
"azure": {
33+
"resource": {
34+
"id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/IMERLISHVILI-TEST/PROVIDERS/MICROSOFT.WEB/SITES/LEMON-FLOWER-AF075F43C47545E6B4248C46905E5188"
35+
},
36+
"app_service": {
37+
"result_description": "169.254.129.1 - - [28/Oct/2025:09:39:57 +0000] \"GET /static/favicon.ico HTTP/1.1\" 200 0 \"https://lemon-flower-af075f43c47545e6b4248c46905e5188.azurewebsites.net/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\"",
38+
"level": "Informational",
39+
"event_stamp_name": "waws-prod-fra-033",
40+
"operation_name": "Microsoft.Web/sites/log",
41+
"event_ip_address": "10.30.0.225",
42+
"event_primary_stamp_name": "waws-prod-fra-033",
43+
"event_stamp_type": "Stamp",
44+
"host": "10-30-0-225",
45+
"category": "AppServiceConsoleLogs",
46+
"container_id": "a9ea19c60625_lemon-flower-af075f43c47545e6b4248c46905e5188"
47+
}
48+
}
49+
}

‎packages/azure_app_service/docs/README.md‎

Lines changed: 57 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -16,44 +16,65 @@ This integration currently collects one data stream:
1616

1717
- App Service Logs
1818

19-
## Requirements
20-
21-
### Credentials
22-
23-
`eventhub` :
24-
_string_
25-
Is the fully managed, real-time data ingestion service.
26-
27-
`consumer_group` :
28-
_string_
29-
The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets.
30-
Default value: `$Default`
31-
32-
`connection_string` :
33-
_string_
34-
The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string.
35-
36-
A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages.
37-
38-
`storage_account` :
39-
_string_
40-
The name of the storage account the state/offsets will be stored and updated.
41-
42-
`storage_account_key` :
43-
_string_
44-
The storage account key, this key will be used to authorize access to data in your storage account.
45-
46-
`resource_manager_endpoint` :
47-
_string_
48-
Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment.
49-
Ex:
50-
https://management.chinacloudapi.cn/ for azure ChinaCloud
51-
https://management.microsoftazure.de/ for azure GermanCloud
52-
https://management.azure.com/ for azure PublicCloud
53-
https://management.usgovcloudapi.net/ for azure USGovernmentCloud
54-
Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints.
19+
## Requirements and setup
20+
Refer to the [Azure Logs](https://docs.elastic.co/integrations/azure) page for more information on how to set up and use this integration.
5521

5622
## App Service Logs
23+
Collects different types of logs from Azure App Service via Event Hub.
24+
25+
An example event for `app_service` looks as following:
26+
27+
```json
28+
{
29+
"agent": {
30+
"name": "EPGETBIW05AD",
31+
"id": "e42ad9e7-fc37-4342-80cc-ee5bcb314f5d",
32+
"ephemeral_id": "65e0aae6-d877-4830-b9f0-10b0ccd39bb9",
33+
"type": "filebeat",
34+
"version": "8.18.3"
35+
},
36+
"@timestamp": "2025-10-28T09:39:57.805Z",
37+
"ecs": {
38+
"version": "8.11.0"
39+
},
40+
"data_stream": {
41+
"namespace": "default",
42+
"type": "logs",
43+
"dataset": "azure_app_service.app_service_logs"
44+
},
45+
"elastic_agent": {
46+
"id": "e42ad9e7-fc37-4342-80cc-ee5bcb314f5d",
47+
"version": "8.18.3",
48+
"snapshot": false
49+
},
50+
"event": {
51+
"agent_id_status": "verified",
52+
"ingested": "2025-10-28T09:40:37Z",
53+
"dataset": "azure_app_service.app_service_logs"
54+
},
55+
"tags": [
56+
"azure-appservice",
57+
"forwarded"
58+
],
59+
"azure": {
60+
"resource": {
61+
"id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/IMERLISHVILI-TEST/PROVIDERS/MICROSOFT.WEB/SITES/LEMON-FLOWER-AF075F43C47545E6B4248C46905E5188"
62+
},
63+
"app_service": {
64+
"result_description": "169.254.129.1 - - [28/Oct/2025:09:39:57 +0000] \"GET /static/favicon.ico HTTP/1.1\" 200 0 \"https://lemon-flower-af075f43c47545e6b4248c46905e5188.azurewebsites.net/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\"",
65+
"level": "Informational",
66+
"event_stamp_name": "waws-prod-fra-033",
67+
"operation_name": "Microsoft.Web/sites/log",
68+
"event_ip_address": "10.30.0.225",
69+
"event_primary_stamp_name": "waws-prod-fra-033",
70+
"event_stamp_type": "Stamp",
71+
"host": "10-30-0-225",
72+
"category": "AppServiceConsoleLogs",
73+
"container_id": "a9ea19c60625_lemon-flower-af075f43c47545e6b4248c46905e5188"
74+
}
75+
}
76+
}
77+
```
5778

5879
**ECS Field Reference**
5980

‎packages/azure_app_service/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.2"
22
name: azure_app_service
33
title: "Azure App Service"
4-
version: "0.8.0"
4+
version: "0.9.0"
55
source:
66
license: "Elastic-2.0"
77
description: "Collect logs from Azure App Service with Elastic Agent."

0 commit comments

Comments
 (0)