Filebeat azure module multiple eventhubs in self managed elastic version 8.6.1

[Dov_Zelinger]

Hi,

As written in the below link, the issue was resolved.
multiple-event-hubs
Unfortunately, the issue still exists.
When configuring multiple platformlogs as can be seen below, only one of them gets active and that will be the last one.
I have 36 EventHubs i need to connect to (one eventhub per each azure region).

What is the exact configuration syntax to achieve that?

  platformlogs:
    enabled: true
    var:
      eventhub: ""
      consumer_group: "elk"
      connection_string: ""
      storage_account: "elkcheckpoint"
      storage_account_key: ""
      storage_account_container: ""

  platformlogs:
    enabled: true
    var:
      eventhub: ""
      consumer_group: "elk"
      connection_string: ""
      storage_account: "elkcheckpoint"
      storage_account_key: ""

Reagrds,
Dov Zelinger

[zmoog (Maurizio Branca)]

Hey @Dov_Zelinger,

I guess we need to define multiple modules, for example:

# Module: azure
# Docs: https://www.elastic.co/guide/en/beats/filebeat/main/filebeat-module-azure.html

- module: azure
  signinlogs:
    enabled: true
    var:
      eventhub: ".."
      consumer_group: ".."
      connection_string: ".."
      storage_account: ".."
      storage_account_key: ".."

- module: azure
  signinlogs:
    enabled: true
    var:
      eventhub: ""
      consumer_group: ""
      connection_string: ""
      storage_account: ""
      storage_account_key: ""

I ran a quick test, and with this configuration, I can spot two azure-eventhub inputs starting in the logs.

Let me know if it works for your use case.

--
Maurizio