Menu
Grafana Cloud

loki.source.azure_event_hubs

loki.source.azure_event_hubs receives Azure Event Hubs messages by making use of an Apache Kafka endpoint on Event Hubs. For more information, see the Azure Event Hubs documentation.

To learn more about streaming Azure logs to an Azure Event Hubs, refer to Microsoft’s tutorial on how to Stream Azure Active Directory logs to an Azure event hub.

Note that an Apache Kafka endpoint is not available within the Basic pricing plan. For more information, see the Event Hubs pricing page.

Multiple loki.source.azure_event_hubs components can be specified by giving them different labels.

Usage

alloy
loki.source.azure_event_hubs "LABEL" {
	fully_qualified_namespace = "HOST:PORT"
	event_hubs                = EVENT_HUB_LIST
	forward_to                = RECEIVER_LIST

	authentication {
		mechanism = "AUTHENTICATION_MECHANISM"
	}
}

Arguments

loki.source.azure_event_hubs supports the following arguments:

NameTypeDescriptionDefaultRequired
fully_qualified_namespacestringEvent hub namespace.yes
event_hubslist(string)Event Hubs to consume.yes
group_idstringThe Kafka consumer group id."loki.source.azure_event_hubs"no
assignorstringThe consumer group rebalancing strategy to use."range"no
use_incoming_timestampboolWhether or not to use the timestamp received from Azure Event Hub.falseno
labelsmap(string)The labels to associate with each received event.{}no
forward_tolist(LogsReceiver)List of receivers to send log entries to.yes
relabel_rulesRelabelRulesRelabeling rules to apply on log entries.{}no
disallow_custom_messagesboolWhether to ignore messages that don’t match the schema for Azure resource logs.falseno

The fully_qualified_namespace argument must refer to a full HOST:PORT that points to your event hub, such as NAMESPACE.servicebus.windows.net:9093. The assignor argument must be set to one of "range", "roundrobin", or "sticky".

The relabel_rules field can make use of the rules export value from a loki.relabel component to apply one or more relabeling rules to log entries before they’re forwarded to the list of receivers in forward_to.

Labels

The labels map is applied to every message that the component reads.

The following internal labels prefixed with __ are available but are discarded if not relabeled:

  • __meta_kafka_message_key
  • __meta_kafka_topic
  • __meta_kafka_partition
  • __meta_kafka_member_id
  • __meta_kafka_group_id
  • __azure_event_hubs_category

Blocks

The following blocks are supported inside the definition of loki.source.azure_event_hubs:

HierarchyNameDescriptionRequired
authenticationauthenticationAuthentication configuration with Azure Event Hub.yes

authentication block

The authentication block defines the authentication method when communicating with Azure Event Hub.

NameTypeDescriptionDefaultRequired
mechanismstringAuthentication mechanism.yes
connection_stringsecretEvent Hubs ConnectionString for authentication on Azure Cloud.no
scopeslist(string)Access token scopes. Default is fully_qualified_namespace without port.no

mechanism supports the values "connection_string" and "oauth". If "connection_string" is used, you must set the connection_string attribute. If "oauth" is used, you must configure one of the supported credential types as documented here: https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/README.md#credential-types via environment variables or Azure CLI.

Exported fields

loki.source.azure_event_hubs doesn’t export any fields.

Component health

loki.source.azure_event_hubs is only reported as unhealthy if given an invalid configuration.

Debug information

loki.source.azure_event_hubs doesn’t expose additional debug info.

Example

This example consumes messages from Azure Event Hub and uses OAuth to authenticate itself.

alloy
loki.source.azure_event_hubs "example" {
	fully_qualified_namespace = "my-ns.servicebus.windows.net:9093"
	event_hubs                = ["gw-logs"]
	forward_to                = [loki.write.example.receiver]

	authentication {
		mechanism = "oauth"
	}
}

loki.write "example" {
	endpoint {
		url = "loki:3100/api/v1/push"
	}
}

Compatible components

loki.source.azure_event_hubs can accept arguments from the following components:

Note

Connecting some components may not be sensible or components may require further configuration to make the connection work correctly. Refer to the linked documentation for more details.