MS managed SQL server diagnostic settings connection to Elastic Cloud

Elastic Observability
1

We have a managed SQL server on Azure with one SQL DB.

It has auditing enabled on server level which the DB inherits, and diagnostic settings are set up with two targets: log analytics and elastic cloud (azure partner solution).

The logs are appearing in the Log Analytics Workspace (Azure native logging solution), however not in Elastic cloud (Diagnostic setting for other resources like datafactory are showing up into Elastic cloud and seem to work as intended)

Does anyone have an idea what could be wrong or how to troubleshoot this?

2

Redeploying diagnostic settings seems to resolve things. Logs are streaming now. It can take up to 90 minutes before logs are received initially.

Another sidenote is that the auditing policy can only send logs to log analytics (or storage account or eventhub) and not to a partner solution, which is confusing given that there are log categories inside diagnostic settings that do not become active unless audit policy is active, and even then are not streamed to the partner solution (for example SQLSecurityAuditEvents)