[azure logs] Document Azure logs categories routing rules #13863
Conversation
zmoog added documentation 
🚀 Benchmarks reportPackage |
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
identity_protection | 4166.67 | 3508.77 | -657.9 (-15.79%) | 💔 |
To see the full report comment with /test benchmark fullreport
zmoog added the Team:Security-Service Integrations 
| Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Co-authored-by: kaiyan-sheng <kaiyan.sheng@elastic.co>
|
💚 Build Succeeded
History
cc @zmoog |
| Use the following table to identify the target data streams for each log category. For example, if the integration receives a log event with the `NonInteractiveUserSignInLogs` category, it will infer `azure.signinlogs` as dataset, indexing the log into `logs-azure.signinlogs-default` data stream. | ||
| | ||
| | Data Stream | Log Category | | ||
| | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | `logs-azure.activitylogs-*` | Administrative, Security, ServiceHealth, Alert, Recommendation, Policy, Autoscale, ResourceHealth | |
There was a problem hiding this comment.
I'm wondering about the typeface agreement between the text in the description and the text in the table; in the description we have NonInteractiveUserSignInLogs, but in the table we have NonInteractiveUserSignInLogs. 99.9999% of people won't notice this, but it did confuse me.
There was a problem hiding this comment.
Yeah, after I looked at the last screenshot, I had a similar thought. Your comment confirms to me that it's not something I should overlook.
efd6 left a comment
efd6 left a comment There was a problem hiding this comment.
Query about typesetting, but you can ignore it if you do not think it is important.
| I merged this PR earlier than planned. I'll open another PR to align the typefaces and update the changelog. |
| Package azure - 1.23.3 containing this change is available at https://epr.elastic.co/package/azure/1.23.3/ |
6 participants
Proposed commit message
Add a table with all the supported log categories and the destination dataset. It also highlights that the integration indexes the unsupported log categories using the
azure.platformlogsdataset.Checklist
I have verified that all data streams collect metrics or logs.changelog.ymlfile.I have verified that any added dashboard complies with Kibana's Dashboard good practicesHow to test this PR locally
Screenshots