elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
22 stars 435 forks source link

[Azure App Service] Missing azure.subscription_id #11172

Open ckauf opened 1 month ago

ckauf commented 1 month ago

None of the Azure App Service Datasets contains the azure.subscription_id field. This can be validated by checking the expected JSONs, e.g. here: https://github.com/elastic/integrations/blob/main/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json

For comparison a Azure Activity Logs example https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-edgecases.log-expected.json

ckauf commented 1 month ago

Upon closer inspection it looks like the included azure shared pipeline is not executed. However that would also not solve the problem because the App Service integration parses the fields to azure.resource.id while the shared pipeline expects it to be in azure.resource_id.