Hi,
Our sign-in logs from Azure suddenly stopped 3 months ago. We did it twice by deleting and resetting the integration, but it could bring it back for 2 days, then it would stop again. We are still receiving the audit logs, though.
Integration version: 1.28.7
Elastic version: 9.1.3
Elastic Agent version: 9.1.3
These are the logs when generating a new integration:
{"log.level":"info","@timestamp":"2025-10-14T18:04:01.084Z","message":"Input 'azure-eventhub' starting","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"ecs.version":"1.6.0","log.logger":"input.azure-eventhub","log.origin":{"file.line":141,"file.name":"compat/compat.go","function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1"},"service.name":"filebeat","id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T18:04:01.084Z","message":"registering","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"log.origin":{"file.line":163,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewMetricsRegistry"},"id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","registry_id":"azure-eventhub-azure_signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","input_id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","service.name":"filebeat","input_type":"azure-eventhub","ecs.version":"1.6.0","log.logger":"input.azure-eventhub.metric_registry","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-10-14T18:04:01.085Z","message":"parent metrics registry already contains a \"azure-eventhub-azure_signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209\" registry, reusing it","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"log.logger":"metric_registry","service.name":"filebeat","input_id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","registry_id":"azure-eventhub-azure_signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0","log.origin":{"file.line":75,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewInputRegistry"},"input_type":"azure-eventhub","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T18:04:01.085Z","message":"registering","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"input_type":"azure-eventhub","ecs.version":"1.6.0","log.logger":"metric_registry","log.origin":{"file.line":86,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewInputRegistry"},"service.name":"filebeat","input_id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","registry_id":"azure-eventhub-azure_signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T18:04:01.085Z","message":"storage leaser checkpointer created for container \"filebeat-signinlogs-aad-logging-siem\"","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"service.name":"filebeat","connection string":"Endpoint=sb://gl-aad-logging-siem.servicebus.windows.net/","ecs.version":"1.6.0","log.logger":"input.azure-eventhub","log.origin":{"file.line":152,"file.name":"azureeventhub/v1_input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/azureeventhub.(*eventHubInputV1).setup"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T19:34:01.306Z","message":"unregistering","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"log.origin":{"file.line":92,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewInputRegistry.func1"},"service.name":"filebeat","input_type":"azure-eventhub","registry_id":"azure-eventhub-azure_signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0","log.logger":"metric_registry","input_id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T19:34:01.306Z","message":"Input 'azure-eventhub' stopped (goroutine)","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"log.logger":"input.azure-eventhub","log.origin":{"file.line":166,"file.name":"compat/compat.go","function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1"},"service.name":"filebeat","id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T19:34:01.306Z","message":"unregistering","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"log.logger":"input.azure-eventhub.metric_registry","log.origin":{"file.line":179,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.CancelMetricsRegistry"},"service.name":"filebeat","ecs.version":"1.6.0","id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","registry_id":"azure-eventhub-azure_signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","input_id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","input_type":"azure-eventhub","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-14T19:34:01.306Z","message":"Input 'azure-eventhub' stopped (runner)","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"azure-eventhub-default","type":"azure-eventhub"},"log":{"source":"azure-eventhub-default"},"log.origin":{"file.line":174,"file.name":"compat/compat.go","function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Stop"},"service.name":"filebeat","id":"azure-eventhub-azure.signinlogs-95092dd4-84ea-4c48-bdef-02f77fc43209","ecs.version":"1.6.0","log.logger":"input.azure-eventhub","ecs.version":"1.6.0"}