Azure App Service Integration

<div class="condensed-table">
| | |
| --- | --- |
| Version | 0.4.2 [beta] (View all) |
| Compatible Kibana version(s) | 8.13.0 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Elastic |

</div>
The Azure App Service logs integration retrieves different types of logs categories from Azure App Service. Azure App Service provides different logging to help you track, monitor, and debug your web application.

• HTTPLogs help monitor application health, performance and usage patterns.
• AuditLogs provide insights when publishing users successfully log on via one of the App Service publishing protocols.
• IPSecAuditLogs are generated through your application and pushed to Azure Monitoring.
• PlatformLogs are generated through AppService platform for your application.
• ConsoleLogs are generated from application or container.
• AppLogs are generated through your application (ex. logging capabilities)

This integration currently collects one data stream:

• App Service Logs

eventhub : string Is the fully managed, real-time data ingestion service.

consumer_group : string The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. Default value: $Default

connection_string : string The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string.

A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages.

storage_account : string The name of the storage account the state/offsets will be stored and updated.

storage_account_key : string The storage account key, this key will be used to authorize access to data in your storage account.

resource_manager_endpoint : string Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. Ex: https://management.chinacloudapi.cn/ for azure ChinaCloud https://management.microsoftazure.de/ for azure GermanCloud https://management.azure.com/ for azure PublicCloud https://management.usgovcloudapi.net/ for azure USGovernmentCloud Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.