Azure Event Hubs

Azure Event Hubs is a fully managed, real-time data ingestion service capable of receiving and processing millions of events per second with low latency. It provides a distributed streaming platform with built-in partitioning for horizontal scaling.

Event Hubs serves as a central entry point for telemetry data from Azure services, applications, and devices. By connecting Event Hubs to Falcon LogScale Collector, organizations gain centralized visibility into their Azure infrastructure and application logs.

Data Flow

The following diagram shows how Azure Event Hub data flows through Log Collector's ingestion pipeline:

flowchart LR A[Azure Services] --> B[Azure Event Hub] B --> C[LogScale Event Hub Connector] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[JSON Parser] D --> D2[Azure Activity Logs Parser] D --> D3[Azure Diagnostic Logs Parser] D --> D4[Azure Security Center Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Azure Services] --> B[Azure Event Hub] B --> C[LogScale Event Hub Connector] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[JSON Parser] D --> D2[Azure Activity Logs Parser] D --> D3[Azure Diagnostic Logs Parser] D --> D4[Azure Security Center Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

The integration supports Azure Diagnostics logs, Activity logs, and custom application events. Event Hubs handles the high-throughput ingestion while LogScale provides the analysis and retention capabilities.