search

saleem-mirza / serilog-sinks-azure-analytics

Serilog sink which writes to Azure analytics
Apache License 2.0
62 stars 45 forks source link

New configuration using an <credentials> object, instead of the previous <workspaceId>, <authenticationId> #86

Open ibiza240 opened 9 months ago

ibiza240 commented 9 months ago

Hi, first thanks for this awesome library. I am happy to see it evolving and would like to start using the new 6.1.0 version.

Before, with 5.0.0, it was simple configuring it, using workspaceId and authenticationId.

Now, using it requires creating a DCE and DCR and I am hitting a challenge when trying to create a DCR for the log ingestion

I red the short docs located at https://www.nuget.org/packages/Serilog.Sinks.AzureLogAnalytics

I ended up reading the recommended tutorial at https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal

By following instructions on that page, I managed to create a new Application registration, creating its client secret and creating a DCE.

I then tried to create a new table in Log Analytics workspace and got stuck while creating a new DCR.

It seems that a sample file is required for created the DCR as described here. The thing is I am not exactly sure what sample file format I should be providing there, knowing I will be using Serilog.Sinks.AzureAnalytics for sending the log data.

Then there seems to be many additional Powershell steps after that, which I am not sure if I will be required to go through for transformation of the log data.

Would you have more information for helping me provide the correct sample file for creating the proper required DCR please?

Kind regards and thanks for your time

pavel-bstk commented 7 months ago

Sample file for DCR is 

[
    {
        "TimeGenerated": "2024-04-07T00:00:00Z",
        "Event": {
            "prop1": "val1",
            "prop2": "val2"
        }
    },
    {
        "TimeGenerated": "2024-04-07T00:00:01Z",
        "Event": {
            "prop1": "val3",
            "prop2": "val4"
        }
    }
]

Format is hardcoded in AzureLogAnalyticsSink.cs, it just sends the entire Event as a single property. You can create DCR as is, get some logs written, and then adjust the projection based on the values logged as Event.

Please be aware that log serialization is currently broken, sink fails to serialize properties and rendered message. That's fixed in #89, not merged yet.