elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
194 stars 421 forks source link

[Azure App Service] Missing azure.subscription_id #11172

Open ckauf opened 1 day ago

ckauf commented 1 day ago

None of the Azure App Service Datasets contains the azure.subscription_id field. This can be validated by checking the expected JSONs, e.g. here: https://github.com/elastic/integrations/blob/main/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json

For comparison a Azure Activity Logs example https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-edgecases.log-expected.json

ckauf commented 1 day ago

Upon closer inspection it looks like the included azure shared pipeline is not executed. However that would also not solve the problem because the App Service integration parses the fields to azure.resource.id while the shared pipeline expects it to be in azure.resource_id.