Azure Event Hubs
| Typically Used By | Azure users; Cloud-native organizations |
| Description | An integration with Azure Event Hub that enables collection of logs and metrics from Azure services and applications running in Azure. |
| Official Vendor Documentation | https://learn.microsoft.com/en-us/azure/event-hubs |
| Setup Difficulty | 3 (Moderate) |
| Useful for | DevOps , SecOps |
| Primary Use Case | Azure-native log streaming |
| Scenarios not Recommended | Non-Azure environments; Organizations with strict data locality requirements |
| Data Volume Handling | High |
| Authentication Method | SAS token/AAD |
| Fault Tolerance | High |
| Additional Tools Required | Azure subscription |
Azure Event Hubs is a fully managed, real-time data ingestion service capable of receiving and processing millions of events per second with low latency. It provides a distributed streaming platform with features like event retention, capture, and integration with the broader Azure ecosystem. Event Hubs serves as a central event streaming backbone for cloud-native applications, making it ideal for ingesting telemetry, logs, and operational data into a Falcon LogScale Collector repository for real-time analysis and monitoring.
LogScale consumes events from the Event Hub in batches and uses an Azure Blob Storage container to store checkpoints so ingestion can resume from the last committed position.
Azure Event Hubs ingest flowThe following diagram shows how Azure Event Hubs log data flows through Log Collector's ingestion pipeline, highlighting specific parser types applied to the log data before data is compressed, stored in the repository, and indexed for searching:
Before you begin
Identify the Log Collector repository that will receive the data, and the parser that should process the events.
Configure an Azure Event Hub and ensure that the required log source is sending data to it.
Create or identify an Azure Storage account and Blob Storage container for LogScale checkpoint storage.
Ensure you can create an app registration in Microsoft Entra ID, and assign Azure roles.
In Log Collector, ensure your role has the Change Azure ingest feeds and Change ingest feeds permissions.