Skip to content

Commit cef44a2

Browse files
removed FER
1 parent 6af3043 commit cef44a2

File tree

1 file changed

+2
-24
lines changed

1 file changed

+2
-24
lines changed

docs/integrations/microsoft-azure/azure-virtual-network.md

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -95,30 +95,6 @@ You must explicitly enable diagnostic settings and network flow logs for each Vi
9595

9696
When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/VirtualNetwork/Metrics` and `Azure/VirtualNetwork/Logs`.
9797

98-
### Configure Field Extraction Rules
99-
100-
Create a Field Extraction Rule (FER) for Azure Virtual Network by following the instructions [here](/docs/manage/field-extractions/create-field-extraction-rule/).
101-
102-
* **Target Resource Extraction FER**
103-
104-
```sql
105-
Rule Name: AzureVirtualNetworkTargetResourceIdExtractionFER
106-
Applied at: Ingest Time
107-
Scope (Specific Data): tenant_name=* FlowLogFlowEvent
108-
```
109-
110-
```sql title="Parse Expression"
111-
json field=_raw "target_resource_id", "category", "flow_log_resource_id"
112-
| where category="FlowLogFlowEvent"
113-
| toUpperCase(target_resource_id) as target_resource_id
114-
| parse field=target_resource_id "/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/*/*/*" as subscription_id, resource_group, provider_name, resource_type, resource_name
115-
| parse field=resource_name "*/SUBNETS/*" as vnet_name, subnet_name nodrop
116-
| parse field=flow_log_resource_id "NETWORKWATCHERS/NETWORKWATCHER_*/" as region_name nodrop
117-
| if (!isBlank(region_name), toLowerCase(region_name), "global") as location
118-
| if (resource_name matches /SUBNETS/, "SUBNETS", resource_type) as resource_type
119-
| fields subscription_id, location, provider_name, resource_group, resource_type, resource_name
120-
```
121-
12298
### Configure metrics collection
12399

124100
import MetricsSourceBeta from '../../reuse/metrics-source-beta.md';
@@ -216,6 +192,8 @@ As part of the app installation process, the following fields will be created by
216192
- `service_type`. Type of the service that can be accessed with a Azure resource.
217193
- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions).
218194

195+
Also FER `AzureVirtualNetworkTargetResourceIdExtractionFER` will be created as part of the app installation process itself.
196+
219197
## Viewing the Azure Virtual Network app dashboards
220198

221199
import ViewDashboardsIndex from '../../reuse/apps/view-dashboards-index.md';

0 commit comments

Comments
 (0)