[azure logs] Document Azure logs categories routing rules#13863
[azure logs] Document Azure logs categories routing rules#13863zmoog merged 5 commits intoelastic:mainfrom
Conversation
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
identity_protection |
4166.67 | 3508.77 | -657.9 (-15.79%) | 💔 |
To see the full report comment with /test benchmark fullreport
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Co-authored-by: kaiyan-sheng <kaiyan.sheng@elastic.co>
|
💚 Build Succeeded
History
cc @zmoog |
| Use the following table to identify the target data streams for each log category. For example, if the integration receives a log event with the `NonInteractiveUserSignInLogs` category, it will infer `azure.signinlogs` as dataset, indexing the log into `logs-azure.signinlogs-default` data stream. | ||
|
|
||
| | Data Stream | Log Category | | ||
| | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | `logs-azure.activitylogs-*` | Administrative, Security, ServiceHealth, Alert, Recommendation, Policy, Autoscale, ResourceHealth | |
There was a problem hiding this comment.
I'm wondering about the typeface agreement between the text in the description and the text in the table; in the description we have NonInteractiveUserSignInLogs, but in the table we have NonInteractiveUserSignInLogs. 99.9999% of people won't notice this, but it did confuse me.
There was a problem hiding this comment.
Yeah, after I looked at the last screenshot, I had a similar thought. Your comment confirms to me that it's not something I should overlook.
efd6
left a comment
There was a problem hiding this comment.
Query about typesetting, but you can ignore it if you do not think it is important.
|
I merged this PR earlier than planned. I'll open another PR to align the typefaces and update the changelog. |
|
Package azure - 1.23.3 containing this change is available at https://epr.elastic.co/package/azure/1.23.3/ |
Proposed commit message
Add a table with all the supported log categories and the destination dataset. It also highlights that the integration indexes the unsupported log categories using the
azure.platformlogsdataset.Checklist
I have verified that all data streams collect metrics or logs.changelog.ymlfile.I have verified that any added dashboard complies with Kibana's Dashboard good practicesHow to test this PR locally
Screenshots