You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/send-data/collect-from-other-data-sources/azure-monitoring/azure-event-hubs-source-migration.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,7 +40,7 @@ After choosing one of the above two strategies, you will now have an event hub n
40
40
41
41
## Step 2. Configure parameters for your event hub sources
42
42
43
-
1.**Create a shared access policy**. You can create it at the namespace level if you have multiple event hubs by selecting **Shared Access Policies** on the left menu of the **Event Hubs Namespace page**.<br/>
43
+
1.**Create a shared access policy**. You can create it at the namespace level if you have multiple event hubs by selecting **Shared Access Policies** on the left menu of the **Event Hubs Namespace page**.<br/><img src={useBaseUrl('/img/send-data/shared-access-policy.png')} alt="Shared access policy" style={{border: '1px solid gray'}} width="800" />
44
44
2.**Create a consumer group**.
45
45
1. Go to your **Event Hub**.
46
46
2. Select **Consumer groups** on left panel.
@@ -51,7 +51,7 @@ After choosing one of the above two strategies, you will now have an event hub n
51
51
Creating **Consumer Groups** is needed only for the customers using the older event hub namespace, see [Existing event hub namespace](#strategy-a-existing-event-hub-namespaces) section in step 1. The default consumer group is already in use by function so we need to create a new one.
After completing the above steps, you will have **Azure Event Hubs Namespace**, **Event Hubs Instance Name**, **Shared Access Policy**, and **Consumer Group Name** - all four parameters are required for creating an event hub source.
57
57
@@ -71,13 +71,13 @@ After verifying that all the log types are ingesting in your new source, follow
71
71
72
72
If your resource group contains only resources created by the older ARM template, as shown below, and you have created a new namespace in a different resource group, see [Creating new event hub namespace](#strategy-b-creating-new-event-hub-namespaces) section in step 1.
1.**Stopping the data flow in older sumo logic source**. To stop the logs export to the older event hub namespace, we need to delete the older diagnostic settings. You can delete them by following the steps below for each of your azure services that are sending logs to sumo.
77
77
1. Go to **Azure Portal**.
78
78
2. Search for **Diagnostic Settings** in the **Search bar**, it will take you to a page with all the resources which have diagnostic settings.
79
-
3. Select your **subscription**, **resource group** (for the azure service whose logs you are ingesting into sumo), and whose diagnostics status is enabled.<br/>
80
-
4. Select the resource name (whose logs you are ingesting into sumo) it shows a list of diagnostic settings.<br/>
79
+
3. Select your **subscription**, **resource group** (for the azure service whose logs you are ingesting into sumo), and whose diagnostics status is enabled.<br/><img src={useBaseUrl('img/send-data/stopping-dataflow1.png')} alt="Stopping data flow" style={{border: '1px solid gray'}} width="800" />
80
+
4. Select the resource name (whose logs you are ingesting into sumo) it shows a list of diagnostic settings.<br/><img src={useBaseUrl('img/send-data/diagnostic-settings1.png')} alt="Diagnostic settings" style={{border: '1px solid gray'}} width="800" />
81
81
5. Select the setting whose event hub column matches with your older event hub namespace. Go to **Edit settings** corresponding to that setting and delete it.
82
82
2.**Wait for all data to be ingested into Sumo**. The azure function is draining all the logs from the older event hub namespace and sending them to sumo, we will need to wait till it finishes it. You can run a query in sumo with your older source name `(_source=<your older source name>)` and see if all the data has already come into sumo till the date when you deleted the diagnostic settings.
83
83
3.**Verify the new source is ingesting logs without any delay**. You can run the below query to verify the latency.
@@ -92,7 +92,7 @@ If your resource group contains only resources created by the older ARM template
92
92
:::note
93
93
We recommend monitoring the new source for a day to verify the delay.
94
94
:::
95
-
4.**Deleting Resources**. Once you are sure your older data is in sumo and your new source is working without any latency, you can delete the whole resource group by clicking on the **Delete resource group** button.<br/>
95
+
4.**Deleting Resources**. Once you are sure your older data is in sumo and your new source is working without any latency, you can delete the whole resource group by clicking on the **Delete resource group** button.<br/><img src={useBaseUrl('img/send-data/delete-resource-groups.png')} alt="Delete resource groups" style={{border: '1px solid gray'}} width="800" />
96
96
97
97
:::note
98
98
If you see more resources than the ones shown in the above screenshot you can delete all six individual resources (the ones with the prefix sumo) one by one by selecting each resource and clicking on the **Delete** button at the top bar.
@@ -103,7 +103,7 @@ If your resource group contains only resources created by the older ARM template
103
103
104
104
1.**Stopping the data flow in older sumo logic source**. The newer source will start collecting data from the point you created the source. You can verify that by running `(_source=<new source name>)` in sumo. After verifying the logs, you can stop the function apps by following the steps below.
105
105
1. Go to the resource group, where Sumo Logic’s log collection ARM template was deployed, and select the **SumoAzureLogs** Function app.
106
-
2. Click **Stop** at the top bar as shown below.<br/>
106
+
2. Click **Stop** at the top bar as shown below.<br/><img src={useBaseUrl('img/send-data/stopping-dataflow2.png')} alt="Stopping data flow" style={{border: '1px solid gray'}} width="800" />
107
107
2.**Verify the new source is ingesting logs without any delay**. You can run the below query to verify the latency.
108
108
```sql
109
109
_source=<new source name>
@@ -118,7 +118,7 @@ If your resource group contains only resources created by the older ARM template
118
118
We recommend monitoring the new source for a day to verify the delay.
119
119
:::
120
120
121
-
3.**Deleting Resources**. You can delete all 5 individual resources except the **Event Hub Namespace** (the ones with the prefix sumo) by selecting each resource and clicking on the **Delete** button at the top bar.<br/>
121
+
3.**Deleting Resources**. You can delete all 5 individual resources except the **Event Hub Namespace** (the ones with the prefix sumo) by selecting each resource and clicking on the **Delete** button at the top bar.<br/><img src={useBaseUrl('img/send-data/delete-resource-groups1.png')} alt="Delete resource groups" style={{border: '1px solid gray'}} width="800" />
122
122
123
123
:::note
124
124
Before deleting resources, make sure your new source is working without any latency.
0 commit comments