From 4cd8a370adaeb7ee2752840cca692f8fec2145b2 Mon Sep 17 00:00:00 2001 From: Amee Lepcha Date: Tue, 6 May 2025 17:12:39 +0530 Subject: [PATCH 1/9] Updated Azure apps for Azure metrics source compatibility (Apps - Part 1) --- .../azure-application-gateway.md | 102 +++-------------- .../microsoft-azure/azure-functions.md | 101 +++-------------- .../microsoft-azure/azure-load-balancer.md | 106 +++--------------- docs/integrations/microsoft-azure/web-apps.md | 101 +++-------------- 4 files changed, 52 insertions(+), 358 deletions(-) diff --git a/docs/integrations/microsoft-azure/azure-application-gateway.md b/docs/integrations/microsoft-azure/azure-application-gateway.md index f863807efe..200033340c 100644 --- a/docs/integrations/microsoft-azure/azure-application-gateway.md +++ b/docs/integrations/microsoft-azure/azure-application-gateway.md @@ -40,97 +40,9 @@ You must explicitly enable diagnostic settings for each Azure Application Gatewa When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/ApplicationGateway/Logs`, `Azure/ApplicationGateway/Metrics`. - -### Configure field in field schema - -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. -1. Search for the following fields: - - `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). - - `location`. The region to which the resource name belongs to. - - `subscription_id`. ID associated with a subscription where the resource is present. - - `resource_group`. The resource group name where the Azure resource is present. - - `provider_name`. Azure resource provider name (for example, Microsoft.Network). - - `resource_type`. Azure resource type (for example, storage accounts). - - `resource_name`. The name of the resource (for example, storage account name). - - `service_type`. Type of the service that can be accessed with a Azure resource. - - `service_name`. Services that can be accessed with an Azure resource (for example, Azure SQL databases in Azure SQL Server). -1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields). - -### Configure Field Extraction Rules - -Create the following field extraction rules (FER) for Azure Storage by following the instructions in [Create a Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule/). - -#### Azure location extraction FER - - ```sql - Rule Name: AzureLocationExtractionFER - Applied at: Ingest Time - Scope (Specific Data): tenant_name=* - ``` - - ```sql title="Parse Expression" - json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop - | replace(toLowerCase(resourceLocation), " ", "") as resourceLocation - | if (!isBlank(resourceLocation), resourceLocation, location) as location - | if (!isBlank(service_region), service_region, location) as location - | if (isBlank(location), "global", location) as location - | fields location - ``` - -#### Resource ID extraction FER - - ```sql - Rule Name: AzureResourceIdExtractionFER - Applied at: Ingest Time - Scope (Specific Data): tenant_name=* - ``` - - ```sql title="Parse Expression" - json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop - | if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId - | toUpperCase(resourceId) as resourceId - | parse regex field=resourceId "/SUBSCRIPTIONS/(?[^/]+)" nodrop - | parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop - | parse regex field=resourceId "/PROVIDERS/(?[^/]+)" nodrop - | parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?[^/]+)/(?.+)" nodrop - | parse regex field=resource_name "(?[^/]+)(?:/PROVIDERS/[^/]+)?/(?[^/]+)/?(?.+)" nodrop - | if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name - | fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name - ``` - -### Configure metric rules - -Create the following metrics rules by following the instructions in [Create a metrics rule](/docs/metrics/metric-rules-editor/#create-a-metrics-rule). - -#### Azure observability metadata extraction application gateway level - -```sql -Rule Name: AzureObservabilityMetadataExtractionAppGatewayLevel -``` - -```sql title="Metric match expression" -resourceId=/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/*/APPLICATIONGATEWAYS/* tenant_name=* -``` -| Fields extracted | Metric rule | -|:------------------|:---------------------| -| subscription_id | $resourceId._1 | -| resource_group | $resourceId._2 | -| provider_name | $resourceId._3 | -| resource_type | APPLICATIONGATEWAYS | -| resource_name | $resourceId._4 | - ### Configure metrics collection -In this section, you will configure a pipeline for shipping metrics from Azure Monitor to an Event Hub, on to an Azure Function, and finally to an HTTP Source on a hosted collector in Sumo Logic. - -1. Create a hosted collector and tag the `tenant_name` field. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
Azure Tag Tenant Name -2. [Configure an HTTP Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-1-configure-an-http-source). -3. [Configure and deploy the ARM Template](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-2-configure-azure-resources-using-arm-template). -1. [Export metrics to Event Hub](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-3-export-metrics-for-a-particular-resource-to-event-hub). Perform the steps below for each Azure Application Gateway that you want to monitor. - 1. Choose `Stream to an event hub` as destination. - 1. Select `AllMetrics`. - 1. Use the Event hub namespace created by the ARM template in Step 2 above. You can create a new Event hub or use the one created by ARM template. You can use the default policy `RootManageSharedAccessKey` as the policy name.
Azure application gateway metrics -1. Tag the location field in the source with right location value.
Azure Application Gateway Tag Location +To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection @@ -167,6 +79,18 @@ import AppInstallNoDataSourceV2 from '../../reuse/apps/app-install-index-apps-v2 +As part of the app installation process, the following fields will be created by default: + +- `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). +- `location`. The region to which the resource name belongs to. +- `subscription_id`. ID associated with a subscription where the resource is present. +- `resource_group`. The resource group name where the Azure resource is present. +- `provider_name`. Azure resource provider name (for example, Microsoft.Network). +- `resource_type`. Azure resource type (for example, storage accounts). +- `resource_name`. The name of the resource (for example, storage account name). +- `service_type`. Type of the service that can be accessed with a Azure resource. +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). + ## Viewing the Azure Application Gateway dashboards import ViewDashboards from '../../reuse/apps/view-dashboards.md'; diff --git a/docs/integrations/microsoft-azure/azure-functions.md b/docs/integrations/microsoft-azure/azure-functions.md index a7c025733d..7595961aae 100644 --- a/docs/integrations/microsoft-azure/azure-functions.md +++ b/docs/integrations/microsoft-azure/azure-functions.md @@ -43,96 +43,9 @@ You must explicitly enable diagnostic settings for each Azure Functions you want When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/FunctionApp/Logs`, `Azure/FunctionApp/Metrics`. -### Configure field in field schema -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. -1. Search for the following fields: - - `tenant_name`. This field is tagged at the collector level and you can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). - - `location`. The region to which the resource name belongs. - - `subscription_id`. ID associated with a subscription where the resource is present. - - `resource_group`. The resource group name where the Azure resource is present. - - `provider_name`. Azure resource provider name (for example, Microsoft.WEB). - - `resource_type`. Azure resource type (for example, SITES). - - `resource_name`. The name of the resource (for example, Azure Function App name). -1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields). - -### Configure Field Extraction Rules - -Create a Field Extraction Rule (FER) by following the instructions [here](/docs/manage/field-extractions/create-field-extraction-rule/). If the FER already exists with the same name, then skip this step. - -#### Azure Location Extraction FER - -```sql -Rule Name: AzureLocationExtractionFER -Applied at: Ingest Time -Scope (Specific Data): tenant_name=* -``` - -```sql title="Parse Expression" -json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop -| replace(toLowerCase(resourceLocation), " ", "") as resourceLocation -| if (!isBlank(resourceLocation), resourceLocation, location) as location -| if (!isBlank(service_region), service_region, location) as location -| if (isBlank(location), "global", location) as location -| fields location -``` - -#### Resource ID Extraction FER - -```sql -Rule Name: AzureResourceIdExtractionFER -Applied at: Ingest Time -Scope (Specific Data): tenant_name=* -``` - -```sql title="Parse Expression" -json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop -| if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId -| toUpperCase(resourceId) as resourceId -| parse regex field=resourceId "/SUBSCRIPTIONS/(?[^/]+)" nodrop -| parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop -| parse regex field=resourceId "/PROVIDERS/(?[^/]+)" nodrop -| parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?[^/]+)/(?.+)" nodrop -| parse regex field=resource_name "(?[^/]+)(?:/PROVIDERS/[^/]+)?/(?[^/]+)/?(?.+)" nodrop -| if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name -| fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name -``` - - -### Configure metric rules - -#### Azure Observability Metadata Extraction Service Level - -If this rule already exists, there's no need to create it again. - -```sql -Rule Name: AzureObservabilityMetadataExtractionAppServiceLevel -``` - -```sql title="Metric match expression" -resourceId=/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/*/SITES/* tenant_name=* -``` - -| Fields extracted | Metric rule | -|:-----------------|:---------------| -| `subscription_id` | $resourceId._1 | -| `resource_group` | $resourceId._2 | -| `provider_name` | $resourceId._3 | -| `resource_type` | SITES | -| `resource_name` | $resourceId._4 | - - ### Configure metrics collection -In this section, you will configure a pipeline for shipping metrics from Azure Monitor to an Event Hub, onto an Azure Function, and finally to an HTTP Source on a hosted collector in Sumo Logic. - -1. Create a hosted collector and tag the `tenant_name` field. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
Azure Tag Tenant Name -1. [Configure an HTTP Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-1-configure-an-http-source). -1. [Configure and deploy the ARM Template](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-2-configure-azure-resources-using-arm-template). -1. [Export metrics to Event Hub](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-3-export-metrics-for-a-particular-resource-to-event-hub). Perform the steps below for each Azure Functions that you want to monitor. - 1. Choose `Stream to an event hub` as the destination. - 1. Select `AllMetrics`. - 1. Use the Event Hub namespace created by the ARM template in Step 2 above. You can create a new Event Hub or use the one created by the ARM template. You can use the default policy `RootManageSharedAccessKey` as the policy name. -4. Tag the location field in the source with the right location value.
Azure Functions app Tag Location +To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection @@ -177,6 +90,18 @@ import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +As part of the app installation process, the following fields will be created by default: + +- `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). +- `location`. The region to which the resource name belongs to. +- `subscription_id`. ID associated with a subscription where the resource is present. +- `resource_group`. The resource group name where the Azure resource is present. +- `provider_name`. Azure resource provider name (for example, Microsoft.Network). +- `resource_type`. Azure resource type (for example, storage accounts). +- `resource_name`. The name of the resource (for example, storage account name). +- `service_type`. Type of the service that can be accessed with a Azure resource. +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). + ## Viewing the Azure Functions dashboards import ViewDashboards from '../../reuse/apps/view-dashboards.md'; diff --git a/docs/integrations/microsoft-azure/azure-load-balancer.md b/docs/integrations/microsoft-azure/azure-load-balancer.md index 89c8baa824..f0ad872c44 100644 --- a/docs/integrations/microsoft-azure/azure-load-balancer.md +++ b/docs/integrations/microsoft-azure/azure-load-balancer.md @@ -33,101 +33,9 @@ You must explicitly enable diagnostic settings for each Load Balancer you want t When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/LoadBalancer/Logs` and `Azure/LoadBalancer/Metrics`. -### Configure field in field schema - -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. -1. Search for the following fields: - - `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions in the [Microsoft Documentation](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). - - `location`. The region to which the resource name belongs. - - `subscription_id`. ID associated with a subscription where the resource is present. - - `resource_group`. The resource group name where the Azure resource is present. - - `provider_name`. Azure resource provider name (for example, Microsoft.Network). - - `resource_type`. Azure resource type (for example, storage accounts). - - `resource_name`. The name of the resource (for example, storage account name). - - `service_type`. Type of the service that can be accessed with an Azure resource. - - `service_name`. Services that can be accessed with an Azure resource (for example, Azure SQL databases in Azure SQL Server). -1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields). - -### Configure Field Extraction Rules - -Create the following Field Extraction Rules (FER) for Azure Storage by following the instructions in the [Create a Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule/). - -#### Azure location extraction FER - - ```sql - Rule Name: AzureLocationExtractionFER - Applied at: Ingest Time - Scope (Specific Data): tenant_name=* - ``` - - ```sql title="Parse Expression" - json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop - | replace(toLowerCase(resourceLocation), " ", "") as resourceLocation - | if (!isBlank(resourceLocation), resourceLocation, location) as location - | if (!isBlank(service_region), service_region, location) as location - | if (isBlank(location), "global", location) as location - | fields location - ``` - -#### Resource ID extraction FER - - ```sql - Rule Name: AzureResourceIdExtractionFER - Applied at: Ingest Time - Scope (Specific Data): tenant_name=* - ``` - - ```sql title="Parse Expression" - json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop - | if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId - | toUpperCase(resourceId) as resourceId - | parse regex field=resourceId "/SUBSCRIPTIONS/(?[^/]+)" nodrop - | parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop - | parse regex field=resourceId "/PROVIDERS/(?[^/]+)" nodrop - | parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?[^/]+)/(?.+)" nodrop - | parse regex field=resource_name "(?[^/]+)(?:/PROVIDERS/[^/]+)?/(?[^/]+)/?(?.+)" nodrop - | if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name - | fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name - ``` - -### Configure metric rules - -Create the following metrics rules by following the instructions in [Create a metrics rule](/docs/metrics/metric-rules-editor/#create-a-metrics-rule). - -#### Azure observability metadata extraction load balancer level - -```sql -Rule Name: AzureObservabilityMetadataExtractionLoadBalancerLevel -``` - -```sql title="Metric match expression" -resourceId=/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/*/LOADBALANCERS/* tenant_name=* -``` - -| Fields extracted | Metric rule | -|:------------------|:---------------| -| subscription_id | $resourceId._1 | -| resource_group | $resourceId._2 | -| provider_name | $resourceId._3 | -| resource_type | LOADBALANCERS | -| resource_name | $resourceId._4 | - ### Configure metrics collection -In this section, you will configure a pipeline for shipping metrics from Azure Monitor to an Event Hub, onto an Azure Function, and finally to an HTTP Source on a hosted collector in Sumo Logic. - -1. Create a hosted collector and tag the `tenant_name` field. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
Azure Tag Tenant Name -2. [Configure an HTTP Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-1-configure-an-http-source). -3. [Configure and deploy the ARM Template](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-2-configure-azure-resources-using-arm-template). -4. [Export metrics to Event Hub](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-3-export-metrics-for-a-particular-resource-to-event-hub). Perform the steps below for each Load Balancer that you want to monitor. - * Choose `Stream to an event hub` as the destination. - * Select `AllMetrics`. - * Use the Event hub namespace created by the ARM template in Step 2 above. You can create a new Event hub or use the one created by the ARM template. You can use the default policy `RootManageSharedAccessKey` as the policy name.
Azure load balancer metrics -5. Tag the location field in the source with the right location value.
Azure Load Balancer Tag Location - -:::note -SNAT related metrics will appear only when an outbound rule is configured. -::: +To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection @@ -159,6 +67,18 @@ import AppInstallNoDataSourceV2 from '../../reuse/apps/app-install-index-apps-v2 +As part of the app installation process, the following fields will be created by default: + +- `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). +- `location`. The region to which the resource name belongs to. +- `subscription_id`. ID associated with a subscription where the resource is present. +- `resource_group`. The resource group name where the Azure resource is present. +- `provider_name`. Azure resource provider name (for example, Microsoft.Network). +- `resource_type`. Azure resource type (for example, storage accounts). +- `resource_name`. The name of the resource (for example, storage account name). +- `service_type`. Type of the service that can be accessed with a Azure resource. +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). + ## Viewing the Azure Load Balancer dashboards import ViewDashboards from '../../reuse/apps/view-dashboards.md'; diff --git a/docs/integrations/microsoft-azure/web-apps.md b/docs/integrations/microsoft-azure/web-apps.md index fce0fc4a95..74153c1ed8 100644 --- a/docs/integrations/microsoft-azure/web-apps.md +++ b/docs/integrations/microsoft-azure/web-apps.md @@ -64,96 +64,9 @@ You must explicitly enable diagnostic settings for each web app that you want to When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/WebApps/Logs`, `Azure/WebApps/Metrics`. -### Configure field in field schema -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. -1. Search for following fields: - - `tenant_name`. This field is tagged at the collector level and you can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). - - `location`. The region to which the resource name belongs to. - - `subscription_id`. ID associated with a subscription where resource is present. - - `resource_group`. The resource group name where the Azure resource is present. - - `provider_name`. Azure resource provider name (for example, Microsoft.WEB). - - `resource_type`. Azure resource type (for example, SITES). - - `resource_name`. The name of the resource (for example, Azure Function App name). -1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields). - -### Configure Field Extraction Rules - -Create a Field Extraction Rule (FER) by following the instructions [here](/docs/manage/field-extractions/create-field-extraction-rule/). If the FER already exists with same name, then skip this step. - -#### Azure Location Extraction FER - -```sql -Rule Name: AzureLocationExtractionFER -Applied at: Ingest Time -Scope (Specific Data): tenant_name=* -``` - -```sql title="Parse Expression" -json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop -| replace(toLowerCase(resourceLocation), " ", "") as resourceLocation -| if (!isBlank(resourceLocation), resourceLocation, location) as location -| if (!isBlank(service_region), service_region, location) as location -| if (isBlank(location), "global", location) as location -| fields location -``` - -#### Resource ID Extraction FER - -```sql -Rule Name: AzureResourceIdExtractionFER -Applied at: Ingest Time -Scope (Specific Data): tenant_name=* -``` - -```sql title="Parse Expression" -json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop -| if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId -| toUpperCase(resourceId) as resourceId -| parse regex field=resourceId "/SUBSCRIPTIONS/(?[^/]+)" nodrop -| parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop -| parse regex field=resourceId "/PROVIDERS/(?[^/]+)" nodrop -| parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?[^/]+)/(?.+)" nodrop -| parse regex field=resource_name "(?[^/]+)(?:/PROVIDERS/[^/]+)?/(?[^/]+)/?(?.+)" nodrop -| if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name -| fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name -``` - - -### Configure metric rules - -#### Azure Observability Metadata Extraction Service Level - -If this rule already exists, there's no need to create it again. - -```sql -Rule Name: AzureObservabilityMetadataExtractionAppServiceLevel -``` - -```sql title="Metric match expression" -resourceId=/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/*/SITES/* tenant_name=* -``` - -| Fields extracted | Metric rule | -|:-----------------|:---------------| -| `subscription_id` | $resourceId._1 | -| `resource_group` | $resourceId._2 | -| `provider_name` | $resourceId._3 | -| `resource_type` | SITES | -| `resource_name` | $resourceId._4 | - - ### Configure metrics collection -In this section, you will configure a pipeline for shipping metrics from Azure Monitor to an Event Hub, on to an Azure Function, and finally to an HTTP Source on a hosted collector in Sumo Logic. - -1. [Configure an HTTP Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-1-configure-an-http-source). -2. [Configure and deploy the ARM Template](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-2-configure-azure-resources-using-arm-template). -3. [Export metrics to Event Hub](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-3-export-metrics-for-a-particular-resource-to-event-hub). Perform below steps for each Azure WebApps that you want to monitor. - 1. Choose `Stream to an event hub` as destination. - 1. Select `AllMetrics`. - 1. Use the Event Hub namespace created by the ARM template in Step 2 above. You can create a new Event Hub or use the one created by ARM template. You can use the default policy `RootManageSharedAccessKey` as the policy name.
Azure WebApps metrics -4. Tag the location field in the source with right location value.
Azure WebApps Tag Location - +To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection @@ -199,6 +112,18 @@ import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +As part of the app installation process, the following fields will be created by default: + +- `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). +- `location`. The region to which the resource name belongs to. +- `subscription_id`. ID associated with a subscription where the resource is present. +- `resource_group`. The resource group name where the Azure resource is present. +- `provider_name`. Azure resource provider name (for example, Microsoft.Network). +- `resource_type`. Azure resource type (for example, storage accounts). +- `resource_name`. The name of the resource (for example, storage account name). +- `service_type`. Type of the service that can be accessed with a Azure resource. +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). + ## Viewing Azure Web Apps dashboards import ViewDashboards from '../../reuse/apps/view-dashboards.md'; From 61b3d41644efad3fd4956d231163a37bce974e77 Mon Sep 17 00:00:00 2001 From: Amee Lepcha Date: Wed, 7 May 2025 11:55:23 +0530 Subject: [PATCH 2/9] Updated the setup section --- .../integrations/microsoft-azure/azure-application-gateway.md | 4 ++-- docs/integrations/microsoft-azure/azure-functions.md | 4 ++-- docs/integrations/microsoft-azure/azure-load-balancer.md | 4 ++-- docs/integrations/microsoft-azure/web-apps.md | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/integrations/microsoft-azure/azure-application-gateway.md b/docs/integrations/microsoft-azure/azure-application-gateway.md index 200033340c..002d6f20a4 100644 --- a/docs/integrations/microsoft-azure/azure-application-gateway.md +++ b/docs/integrations/microsoft-azure/azure-application-gateway.md @@ -34,7 +34,7 @@ This app supports only Application Gateway V2 since Application Gateway V1 will Azure service sends monitoring data to Azure Monitor, which can then [stream data to Eventhub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports: * Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). -* Metrics collection using our [HTTP Logs and Metrics source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/) via Azure Functions deployed using the ARM template. +* Metrics collection using our [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). You must explicitly enable diagnostic settings for each Azure Application Gateway you want to monitor. You can forward logs to the same event hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations). @@ -42,7 +42,7 @@ When you configure the event hubs source or HTTP source, plan your source catego ### Configure metrics collection -To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). +To set up the Azure Metrics source in Sumo Logic, refer to [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection diff --git a/docs/integrations/microsoft-azure/azure-functions.md b/docs/integrations/microsoft-azure/azure-functions.md index 7595961aae..b7fe4bdc64 100644 --- a/docs/integrations/microsoft-azure/azure-functions.md +++ b/docs/integrations/microsoft-azure/azure-functions.md @@ -37,7 +37,7 @@ tenant_name=* subscription_id=* location=* resource_group=* provider_name=micros Azure service sends monitoring data to Azure Monitor, which can then [stream data to Eventhub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports: * Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). -* Metrics collection using our [HTTP Logs and Metrics source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/) via Azure Functions deployed using the ARM template. +* Metrics collection using our [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). You must explicitly enable diagnostic settings for each Azure Functions you want to monitor. Diagnostic Settings are not supported for function apps running on version 1.x. You can forward logs to the same Event Hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations). @@ -45,7 +45,7 @@ When you configure the event hubs source or HTTP source, plan your source catego ### Configure metrics collection -To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). +To set up the Azure Metrics source in Sumo Logic, refer to [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection diff --git a/docs/integrations/microsoft-azure/azure-load-balancer.md b/docs/integrations/microsoft-azure/azure-load-balancer.md index f0ad872c44..6ad2947f63 100644 --- a/docs/integrations/microsoft-azure/azure-load-balancer.md +++ b/docs/integrations/microsoft-azure/azure-load-balancer.md @@ -27,7 +27,7 @@ This app only supports load balancers of **Standard** and **Gateway** SKUs. Azure service sends monitoring data to Azure Monitor, which can then [stream data to Eventhub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports: -* Metrics collection using our [HTTP Logs and Metrics source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/) via Azure Functions deployed using the ARM template. +* Metrics collection using our [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). You must explicitly enable diagnostic settings for each Load Balancer you want to monitor. You can forward logs to the same event hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations). @@ -35,7 +35,7 @@ When you configure the event hubs source or HTTP source, plan your source catego ### Configure metrics collection -To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). +To set up the Azure Metrics source in Sumo Logic, refer to [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection diff --git a/docs/integrations/microsoft-azure/web-apps.md b/docs/integrations/microsoft-azure/web-apps.md index 74153c1ed8..9dbdd28a48 100644 --- a/docs/integrations/microsoft-azure/web-apps.md +++ b/docs/integrations/microsoft-azure/web-apps.md @@ -58,7 +58,7 @@ Azure service sends monitoring data to Azure Monitor, which can then [stream dat * Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). * Activity Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). It is recommended to create a separate source for activity logs. If you are already collecting these logs, you can skip this step. -* Metrics collection using our [HTTP Logs and Metrics source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/) via Azure Functions deployed using the ARM template. +* Metrics collection using our [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). You must explicitly enable diagnostic settings for each web app that you want to monitor. You can forward logs to the same event hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations). @@ -66,7 +66,7 @@ When you configure the event hubs source or HTTP source, plan your source catego ### Configure metrics collection -To set up the Azure Metrics source in Sumo Logic, refer to the [documentation](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). +To set up the Azure Metrics source in Sumo Logic, refer to [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source). ### Configure logs collection From 1bf042fbbd3199792c91aade9cfc7191213cb0c5 Mon Sep 17 00:00:00 2001 From: Sachin Magar Date: Wed, 7 May 2025 21:52:22 +0530 Subject: [PATCH 3/9] added monitors --- .../microsoft-azure/azure-application-gateway.md | 11 +++++++++++ .../microsoft-azure/azure-load-balancer.md | 10 ++++++++++ docs/integrations/microsoft-azure/kubernetes.md | 4 ++-- 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/docs/integrations/microsoft-azure/azure-application-gateway.md b/docs/integrations/microsoft-azure/azure-application-gateway.md index 002d6f20a4..5646aaa169 100644 --- a/docs/integrations/microsoft-azure/azure-application-gateway.md +++ b/docs/integrations/microsoft-azure/azure-application-gateway.md @@ -168,6 +168,17 @@ import AppUninstall from '../../reuse/apps/app-uninstall.md'; +### Azure Application Gateway alerts +These alerts are metric based and will work for all Azure Application Gateways. + +| Alert Name | Alert Description and Conditions | Alert Condition | Recover Condition | +|:-----------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------|:------------------| +| `Azure Application Gateway - Current Capacity Units` | This alert is triggered when Average Capacity Units count is greater than 75. Also, a warning type alert will be triggered when Average Capacity Units count is greater than 65. | percentage >= 75 | percentage < 75 | +| `Azure Application Gateway - Current Compute Units` | This alert is triggered when Average Compute Units count is greater than 75. Also, a warning type alert will be triggered when Average Compute Units count is greater than 65. | percentage >= 75 | percentage < 75 | +| `Azure Application Gateway - Failed Requests` | This alert is triggered when Failed Requests count greater than 1. | Count >= 1 | Count < 1 | +| `Azure Application Gateway - Healthy Host Count` | This alert is triggered when Healthy Host Count is less than 1. | Count < 1 | Count >= 1 | +| `Azure Application Gateway - UnHealthy Host Count` | This alert is triggered when UnHealthy Host Count is greater than 1 | Count >= 1 | Count < 1 | + ## Troubleshooting ### HTTP Logs and Metrics Source used by Azure Functions diff --git a/docs/integrations/microsoft-azure/azure-load-balancer.md b/docs/integrations/microsoft-azure/azure-load-balancer.md index 6ad2947f63..2a71031606 100644 --- a/docs/integrations/microsoft-azure/azure-load-balancer.md +++ b/docs/integrations/microsoft-azure/azure-load-balancer.md @@ -135,6 +135,16 @@ Use this dashboard to: Azure Load Balancer Policy +### Azure Load Balancer alerts +These alerts are metric based and will work for all Azure Load Balancers. + +| Alert Name | Alert Description and Conditions | Alert Condition | Recover Condition | +|:------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------|:------------------| +| `Azure Load Balancer - Data Path Availability` | This alert is triggered when Data Path Availability is less than 100%. | percentage < 100 | percentage >= 100 | +| `Azure Load Balancer - Health Probe Status` | This alert is triggered when Health Probe Status is less than 100%. | percentage < 100 | percentage >= 100 | +| `Azure Load Balancer - SNAT Connection Count` | This alert is triggered when SNAT Connection count less than 1000. Also Working alert is triggered when SNAT Connection count less than 800 | Count < 1000 | Count >= 1000 | +| `Azure Load Balancer - Used SNAT Ports` | This alert is triggered when Used SNAT Ports count less than 900. Also Working alert is triggered when Used SNAT Ports count less than 800 | Count < 900 | Count >= 900 | + ## Troubleshooting ### HTTP Logs and Metrics Source used by Azure Functions diff --git a/docs/integrations/microsoft-azure/kubernetes.md b/docs/integrations/microsoft-azure/kubernetes.md index 63054f3e5a..66a803d552 100644 --- a/docs/integrations/microsoft-azure/kubernetes.md +++ b/docs/integrations/microsoft-azure/kubernetes.md @@ -386,8 +386,8 @@ The **Azure Kubernetes Service - Node Memory** dashboard provides insights about Azure Kubernetes Service - Node Memory -### Azure Key Vaults alerts -These alerts are metric based and will work for all Key Vaults. +### Azure Kubernetes Service alerts +These alerts are metric based and will work for all Azure Kubernetes Managed Clusters. | Alert Name | Alert Description and Conditions | Alert Condition | Recover Condition | |:--|:--|:--|:--| From fe1d1720421addb7bfaf582915ccd3bebc88a05f Mon Sep 17 00:00:00 2001 From: Amee Lepcha Date: Fri, 9 May 2025 15:50:02 +0530 Subject: [PATCH 4/9] Update docs/integrations/microsoft-azure/azure-functions.md Co-authored-by: John Pipkin (Sumo Logic) --- docs/integrations/microsoft-azure/azure-functions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/microsoft-azure/azure-functions.md b/docs/integrations/microsoft-azure/azure-functions.md index b7fe4bdc64..9a96dba402 100644 --- a/docs/integrations/microsoft-azure/azure-functions.md +++ b/docs/integrations/microsoft-azure/azure-functions.md @@ -100,7 +100,7 @@ As part of the app installation process, the following fields will be created by - `resource_type`. Azure resource type (for example, storage accounts). - `resource_name`. The name of the resource (for example, storage account name). - `service_type`. Type of the service that can be accessed with a Azure resource. -- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions). ## Viewing the Azure Functions dashboards From d0985bd1c35fac7ff8006eb17d022f291c9668d6 Mon Sep 17 00:00:00 2001 From: Amee Lepcha Date: Fri, 9 May 2025 15:50:09 +0530 Subject: [PATCH 5/9] Update docs/integrations/microsoft-azure/azure-application-gateway.md Co-authored-by: John Pipkin (Sumo Logic) --- docs/integrations/microsoft-azure/azure-application-gateway.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/microsoft-azure/azure-application-gateway.md b/docs/integrations/microsoft-azure/azure-application-gateway.md index 5646aaa169..8515a4899a 100644 --- a/docs/integrations/microsoft-azure/azure-application-gateway.md +++ b/docs/integrations/microsoft-azure/azure-application-gateway.md @@ -89,7 +89,7 @@ As part of the app installation process, the following fields will be created by - `resource_type`. Azure resource type (for example, storage accounts). - `resource_name`. The name of the resource (for example, storage account name). - `service_type`. Type of the service that can be accessed with a Azure resource. -- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions). ## Viewing the Azure Application Gateway dashboards From 9e1ab5d0abe7d25bf8453e139a2c155983e36bff Mon Sep 17 00:00:00 2001 From: Amee Lepcha Date: Fri, 9 May 2025 15:50:15 +0530 Subject: [PATCH 6/9] Update docs/integrations/microsoft-azure/azure-load-balancer.md Co-authored-by: John Pipkin (Sumo Logic) --- docs/integrations/microsoft-azure/azure-load-balancer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/microsoft-azure/azure-load-balancer.md b/docs/integrations/microsoft-azure/azure-load-balancer.md index 2a71031606..ea66d23fdc 100644 --- a/docs/integrations/microsoft-azure/azure-load-balancer.md +++ b/docs/integrations/microsoft-azure/azure-load-balancer.md @@ -77,7 +77,7 @@ As part of the app installation process, the following fields will be created by - `resource_type`. Azure resource type (for example, storage accounts). - `resource_name`. The name of the resource (for example, storage account name). - `service_type`. Type of the service that can be accessed with a Azure resource. -- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions). ## Viewing the Azure Load Balancer dashboards From d84ae28f3c0ea091bf535eaed324fe3fe17bfabf Mon Sep 17 00:00:00 2001 From: Amee Lepcha Date: Fri, 9 May 2025 15:50:22 +0530 Subject: [PATCH 7/9] Update docs/integrations/microsoft-azure/web-apps.md Co-authored-by: John Pipkin (Sumo Logic) --- docs/integrations/microsoft-azure/web-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/microsoft-azure/web-apps.md b/docs/integrations/microsoft-azure/web-apps.md index 9dbdd28a48..32a8a40dde 100644 --- a/docs/integrations/microsoft-azure/web-apps.md +++ b/docs/integrations/microsoft-azure/web-apps.md @@ -122,7 +122,7 @@ As part of the app installation process, the following fields will be created by - `resource_type`. Azure resource type (for example, storage accounts). - `resource_name`. The name of the resource (for example, storage account name). - `service_type`. Type of the service that can be accessed with a Azure resource. -- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). +- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions). ## Viewing Azure Web Apps dashboards From 675f528ec0890a3c6151023d07232278139f8d65 Mon Sep 17 00:00:00 2001 From: Apoorv Kudesia Date: Fri, 9 May 2025 16:08:18 +0530 Subject: [PATCH 8/9] SUMO-259572 | Apoorv | Add. Azure Functions monitors and dashboard changes --- .../microsoft-azure/azure-functions.md | 31 ++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/docs/integrations/microsoft-azure/azure-functions.md b/docs/integrations/microsoft-azure/azure-functions.md index 9a96dba402..4315af868a 100644 --- a/docs/integrations/microsoft-azure/azure-functions.md +++ b/docs/integrations/microsoft-azure/azure-functions.md @@ -220,7 +220,7 @@ Use this dashboard to: ### Administrative Operations -The **Azure SQL - Administrative Operations** dashboard provides details on read/write/delete specific changes, different operations used, the top 10 operations that caused the most errors, and users performing admin operations. +The **Azure Functions - Administrative Operations** dashboard provides details on read/write/delete specific changes, different operations used, the top 10 operations that caused the most errors, and users performing admin operations. Use this dashboard to: * Identify top users performing administrative operations. @@ -229,6 +229,35 @@ Use this dashboard to: Azure Functions Administrative Operations dashboard +### Instances + +The **Azure Functions - Instances** dashboard provides information of all effect action details performed based on Azure Functions Instances. + +Use this dashboard to: +* View recent resource usage and performance based on Instances. +* View distribution and service usage of resources by Instance. + +Azure Functions Instances dashboard + + +## Create monitors for Azure Functions app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + + +### Azure Functions alerts +These alerts are metric based and will work for all Functions. + +| Alert Name | Description | Alert Condition | Recover Condition | +|:------------------------------------------|:-------------------------------------------------------------------------------------------|:----------------|:------------------| +| `Azure Functions - Average Response Time` | This alert gets triggered when there is high response time detected in any Azure Function. | Count < 1 | Count >= 1 | +| `Azure Functions - Delete function app` | This alert gets triggered when a function app is deleted. | Count >= 1 | Count < 1 | +| `Azure Functions - Health Check Status` | This alert gets triggered when there is Health Check Status average drops less than 100. | Count < 100 | Count >= 100 | +| `Azure Functions - Http 4xx Error` | This alert gets triggered when HTTP 4xx errors are high in the Azure Functions. | Count > 25 | Count =< 25 | +| `Azure Functions - Https Server Error` | This alert gets triggered when HTTP 5xx errors are high in the Azure Functions. | Count > 25 | Count =< 25 | + + ## Upgrade/Downgrade the Azure Functions app (Optional) import AppUpdate from '../../reuse/apps/app-update.md'; From f31f7d6408134895cbdfc5ccf4b1f0cb1050bb5d Mon Sep 17 00:00:00 2001 From: Apoorv A Kudesia Date: Mon, 12 May 2025 18:50:26 +0530 Subject: [PATCH 9/9] Update docs/integrations/microsoft-azure/azure-functions.md Co-authored-by: Kim (Sumo Logic) <56411016+kimsauce@users.noreply.github.com> --- docs/integrations/microsoft-azure/azure-functions.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/integrations/microsoft-azure/azure-functions.md b/docs/integrations/microsoft-azure/azure-functions.md index 4315af868a..17fa1bedd8 100644 --- a/docs/integrations/microsoft-azure/azure-functions.md +++ b/docs/integrations/microsoft-azure/azure-functions.md @@ -247,7 +247,8 @@ import CreateMonitors from '../../reuse/apps/create-monitors.md'; ### Azure Functions alerts -These alerts are metric based and will work for all Functions. + +These alerts are metrics-based and will work for all Functions. | Alert Name | Description | Alert Condition | Recover Condition | |:------------------------------------------|:-------------------------------------------------------------------------------------------|:----------------|:------------------|