currently we are tryting to ship logs from azure eventhub to logstash. We use this: Azure Event Hubs plugin | Logstash Reference [7.11] | Elastic to forward the logs to elastic cluster.
As far as I have learnt from the documentation: Azure Activity Log event schema - Azure Monitor | Microsoft Docs it looks like the log schema differs when you are sending it to the azure event hub, which means it differs from what you can see in azure.
Due to this I miss some information at the end in elastic, for example resourceGroupName, which is quite important to filter and aggregate the logs.
Is there anyone who is facing same issue and if yes how are you dealing with it?
Is there any way to adjust the event hub or diagnostic settings in a certain way so it forwards the logs in the exact same format as you can see them in your azure resource? Or are you adding these information (like the resource group names) in your logstash filter to every event?
Thanks for any feedback