Merge pull request #79219 from nkiest/patch-3

Update stream-monitoring-data-event-hubs.md

Author: PRMerger15

articles/azure-monitor/platform/stream-monitoring-data-event-hubs.md

@@ -1,12 +1,12 @@
 ---
 title: Stream Azure monitoring data to Event Hubs
 description: Learn how to stream your Azure monitoring data to an event hub to get the data into a partner SIEM or analytics tool.
-author: johnkemnetz
+author: nkiest
 services: azure-monitor
 ms.service: azure-monitor
 ms.topic: conceptual
 ms.date: 11/01/2018
-ms.author: johnkem
+ms.author: nikiest
 ms.subservice: ""
 ---
 # Stream Azure monitoring data to an event hub for consumption by an external tool
@@ -37,8 +37,8 @@ Before you begin, you need to [create an Event Hubs namespace and event hub](../
 * The number of throughput units allows you to increase throughput scale for your event hubs. The number of partitions allows you to parallelize consumption across many consumers. A single partition can do up to 20MBps, or approximately 20,000 messages per second. Depending on the tool consuming the data, it may or may not support consuming from multiple partitions. If you're not sure about the number of partitions to set, we recommend starting with four partitions.
 * We recommend that you set message retention on your event hub to 7 days. If your consuming tool goes down for more than a day, this ensures that the tool can pick up where it left off (for events up to 7 days old).
 * We recommend using the default consumer group for your event hub. There is no need to create other consumer groups or use a separate consumer group unless you plan to have two different tools consume the same data from the same event hub.
-* For the Azure Activity log, you pick an Event Hubs namespace and Azure Monitor creates an event hub within that namespace called 'insights-logs-operationallogs.' For other log types, you can either choose an existing event hub (allowing you to reuse the same insights-logs-operationallogs event hub) or have Azure Monitor create an event hub per log category.
-* Typically, port 5671 and 5672 must be opened on the machine consuming data from the event hub.
+* For the Azure Activity log, you pick an Event Hubs namespace and Azure Monitor creates an event hub within that namespace called 'insights-logs-operational-logs.' For other log types, you can either choose an existing event hub (allowing you to reuse the same insights-logs-operational-logs event hub) or have Azure Monitor create an event hub per log category.
+* Typically, outbound port 5671 and 5672 must be opened on the machine or VNET consuming data from the event hub.
 
 Please also see the [Azure Event Hubs FAQ](../../event-hubs/event-hubs-faq.md).