# Azure Activity Log to Logstash

**URL:** <https://discuss.elastic.co/t/azure-activity-log-to-logstash/141418>\
**Category:** Logstash\
**Created:** [July 24, 2018, 3:16pm UTC](https://discuss.elastic.co/t/azure-activity-log-to-logstash/141418 "2018-07-24T15:16:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelsteven](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@michaelsteven](https://discuss.elastic.co/u/michaelsteven)\
**Post date:** [July 24, 2018, 3:16pm UTC](https://discuss.elastic.co/t/azure-activity-log-to-logstash/141418/1 "2018-07-24T15:16:47Z")

</div>

I want to have the Azure Monitor-Activity Log data piped into Elasticsearch, and using the Logstash Plug-in found here ([https://github.com/logstash-plugins/logstash-input-azure\_event\_hubs](https://github.com/logstash-plugins/logstash-input-azure_event_hubs)). I have it configured and am able to see the log data, but it appears to be missing some of the detail.

Azure's Monitor-Activity log has the ability to view the JSON data, and from that I can see the operationName formatted like "operationName":{"value": "Microsoft.Resources/Deployments/Write", "localizedValue": "Create deployment"}.

When i read the data into ELK using the logstash plugin and see it in Kibana, the message has json data with operationName flattened to just the string value, i.e. "Microsoft.Resources/Deployments/Write", and the more user friendly localizedValue is absent.

I'm not sure if it's coming from the Event Hub without the localizedValue or not. I'm on a free trial tier account with azure so I can't easily send it to the blob store or clear lake storage to examine closer. I hope to to talk to someone from Microsoft later in the week.

Anybody have luck getting the localizedValue fields into elk from the Azure Activity logs?

Thanks,

Michael H.

* * *

Here is the logstash config i'm using with that filter:  
input  
{  
azure\_event\_hubs  
{  
event\_hub\_connections =\> ["Endpoint=sb://foo.servicebus.windows.net/;SharedAccessKeyName=SAS\_bar;SharedAccessKey=\*\*\*\*;EntityPath=insights-operational-logs"]  
threads =\> 4  
decorate\_events =\> true  
consumer\_group =\> "$Default"  
}  
}  
filter {  
json {  
source =\> "message"  
}  
split { field =\> 'records' }  
date { match =\> ["[records][time]", "HH:mm:ss.SSS" ] }  
}  
output {  
elasticsearch {  
index =\> "insights-operational-logs-%{+YYYY.MM.dd}"  
hosts =\> ["127.0.0.1:9200"]  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2018, 3:20pm UTC](https://discuss.elastic.co/t/azure-activity-log-to-logstash/141418/2 "2018-08-21T15:20:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.