{"id":84314,"date":"2021-01-07T08:09:22","date_gmt":"2021-01-07T16:09:22","guid":{"rendered":""},"modified":"2025-06-23T11:17:21","modified_gmt":"2025-06-23T18:17:21","slug":"how-to-monitor-azure-infrastructure-filebeat-elastic-observability","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/","title":{"rendered":"How to monitor your Azure infrastructure with Filebeat and Elastic Observability"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"overview\">Overview<\/h2>\n\n\n\n<p>The ability to access the internal state of your application ecosystem is critical to optimizing your applications and the experience of your users. Elastic Cloud on Microsoft Azure gives you access to Elastic observability allowing you to monitor your infrastructure and see how every signal interrelates by utilizing a wide variety of resources that can be deployed in minutes.<\/p>\n\n\n\n<p>By using our Elasticsearch managed service on Azure, you get to take advantage of benefits such as one-click upgrades and much more, simplifying your IT operations. For more details go to Elastic Cloud. We help you bring your logs, metrics, and APM traces together at scale so you can easily assess the current state of your system. You can also use machine learning to detect anomalies and alerting to let you know what is awry, so you can quickly react to events happening in your environment.<\/p>\n\n\n\n<p>The first step towards observability is usually log aggregation\/analytics. With that being said, what is Filebeat? Well, Filebeat is a lightweight shipper for forwarding and centralizing log data and files. By installing Filebeat as an agent on your servers, you\u2019re able to collect log events and forward them to either <a href=\"https:\/\/www.elastic.co\/elasticsearch\/\">Elasticsearch<\/a> or <a href=\"https:\/\/www.elastic.co\/logstash\">Logstash<\/a> for indexing.<\/p>\n\n\n\n<p>In a previous blog, <a href=\"https:\/\/cloudblogs.microsoft.com\/opensource\/2020\/10\/21\/how-to-deploy-elastic-cloud-microsoft-azure\/\">Getting Started with Elastic Cloud on Microsoft Azure<\/a>, we showed you how easy it is to get up and running with Elastic Cloud on Azure, taking full advantage of integrated billing. Check it out if you have not already spun up your deployment in anticipation of this blog. Signing up for the <a href=\"https:\/\/azuremarketplace.microsoft.com\/en-us\/marketplace\/apps\/elastic.ec-azure-pp?tab=Overview\">Elastic Cloud (Elasticsearch managed service)<\/a> through the Azure Marketplace takes a short time and offers great flexibility, so try it out today.<\/p>\n\n\n\n<p>The intent here is to show you how easy it is to get Azure activity logs into Elasticsearch with Filebeat and visualize the aggregated data with <a href=\"https:\/\/www.elastic.co\/kibana\">Kibana<\/a>. Kibana provides powerful out-of-the-box visualizations and dashboards to search and analyze your data, reducing the amount of time and effort to get started.<\/p>\n\n\n\n<p>With the Elasticsearch managed service on Azure you can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Monitor your activity, sign-in, and audit logs using the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/filebeat-module-azure.html\">Filebeat Azure module<\/a> with Event Hub<\/li>\n\n\n\n<li>Analyze your compute, container, database storage, billing, and application insight metrics using the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/metricbeat\/current\/metricbeat-module-azure.html\">Metricbeat Azure module<\/a> (covered in a future blog)<\/li>\n<\/ul>\n\n\n\n<p>Analyze them all under one <a href=\"https:\/\/www.elastic.co\/observability\">Elastic Observability<\/a> solution!<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/1_Architecture-5ff39bd741bc3.png\" alt=\"Elastic architecture\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"ingesting-logs\">Ingesting logs<\/h2>\n\n\n\n<p>Kibana, the visualization and administrative interface for the Elastic Stack, you&#8217;ll find instructions for the installation of <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/filebeat-overview.html\">Filebeat<\/a>, which we&#8217;ll use to ingest the Azure activity, sign-in, and\/or audit logs mentioned earlier.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"download-and-install-filebeat\">Download and install Filebeat<\/h2>\n\n\n\n<p>Starting with deployment version 7.10*, from the Kibana Home page click <strong>Install Filebeat<\/strong>.<\/p>\n\n\n\n<p>*If you have not yet upgraded your deployment to 7.10, take the time to visit our <a href=\"https:\/\/www.elastic.co\/guide\/en\/cloud\/current\/ec-upgrade-deployment.html\">Upgrade versions<\/a> documentation. The upgrades are designed to be automated while helping mitigate unplanned downtime.<\/p>\n\n\n\n<p>To begin with, click the navigation menu and then <strong>Home<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/2_Home-5ff39be04df8b.png\" alt=\"Snapshot of Elastic home\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Click <strong>Add data<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/3_Add-data-5ff39be826922.png\" alt=\"Snapshot of &quot;ingest your data&quot; step\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>This has taken us to the <strong>Add data<\/strong> menu, where we will choose <strong>Azure logs<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/4_Azure-logs-5ff39bf1a8f9a.png\" alt=\"graphical user interface, text, application\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Follow the steps to install Filebeat on your system. You can click the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/exported-fields-azure.html\">View exported fields<\/a> and <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/7.9\/filebeat-module-azure.html\">Learn more<\/a> links to reference additional Filebeat information.<\/p>\n\n\n\n<p>You can leave this page open for when you&#8217;ve completed the following configurations, as we will come back to it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configure-filebeat\">Configure Filebeat<\/h2>\n\n\n\n<p>Once Filebeat for your particular system has been downloaded and installed, you will need to modify the <code>filebeat.yml<\/code> file.<\/p>\n\n\n\n<p>On a Linux system, this is typically found under <code>\/etc\/filebeat<\/code>.<\/p>\n\n\n\n<p>The great thing about running through this process from Kibana, is that it will show you how to add the necessary entries to that file in order to communicate with your Elastic Cloud deployment &#8211; two variables <code>cloud.id<\/code> and <code>cloud.auth<\/code> that you must modify.<\/p>\n\n\n\n<p>For those who have Elastic Stack running self-managed in their own Azure account, please refer to the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/filebeat-installation-configuration.html#set-connection\">Connect to Elastic Stack<\/a> Filebeat Quick start guide.<\/p>\n\n\n\n<p><strong>Tip<\/strong>: Not sure where to get these values? Refer to our <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/configure-cloud-id.html\">documentation<\/a> for more details.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"create-an-event-hub\">Create an Event Hub<\/h2>\n\n\n\n<p>This solution requires the use of <strong>Azure Event Hub<\/strong> for the activity, sign-in, and\/or audit logs, as well as access to a <strong>storage blob<\/strong>. If you do not have such an event hub set up, please refer to the <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/event-hubs\/event-hubs-create\">Create an Azure event hub quick start<\/a> documentation for details. You will then need to refer to the <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/activity-log#legacy-collection-methods\">instructions on sending activity logs<\/a> to the event hub.<\/p>\n\n\n\n<p>When creating an event hub, you can add it to an existing namespace if you already have one, or you can create an entirely new one, as we will demonstrate here.<\/p>\n\n\n\n<p>From your Azure portal <a href=\"https:\/\/portal.azure.com\/#blade\/HubsExtension\/BrowseResourceBlade\/resourceType\/Microsoft.EventHub%2Fnamespaces\">Event Hubs<\/a>, click <strong>Add<\/strong>.<\/p>\n\n\n\n<p>You must select a resource group, and then name it: for example, <strong>elastic-eventhub<\/strong>.<\/p>\n\n\n\n<p>Choose the location and pricing tier and then proceed, adding optional tags if desired, then click <strong>Create<\/strong>.<\/p>\n\n\n\n<p>Click <strong>Shared access policies<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/5_shared-access-policy.png\" alt=\"Shared access policies snapshot\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Click the default policy that appears, named <strong>RootManageSharedAccessKey<\/strong> and then click to copy the connection string. Paste that somewhere safe, as it will be used to configure the Filebeat Azure module configuration file, <code>azure.yml<\/code>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/6_SAS-policy.png\" alt=\"SAS Policy\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Navigate to <strong>Activity Logs<\/strong> and then click <strong>Diagnostics settings<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/7_Activity-log.png\" alt=\"Activity log\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Click <strong>Add diagnostic setting<\/strong> and name it <strong>elastic-diag<\/strong>.<\/p>\n\n\n\n<p>Select the logs of your choice, and then be sure to also select <strong>Stream to an event hub<\/strong>.<\/p>\n\n\n\n<p>Choose the <strong>elastic-eventhub<\/strong> namespace, select the <strong>(Create in selected namespace)<\/strong> option for the event hub name, then select the <strong>RootManageShareAccessKey<\/strong> policy.<\/p>\n\n\n\n<p>An event hub named <strong>insights-activity-logs<\/strong> will be created for you, appearing under the <strong>elastic-eventhub<\/strong> namespace, for which we will use in the <code>azure.yml<\/code> configuration file.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/8_Destination-details.png\" alt=\"Destination details\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Click <strong>Save,<\/strong> then optionally navigate back to <strong>elastic-eventhub<\/strong> and to see the event metrics coming in.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/9_eventhub-metrics.png\" alt=\"Eventhub metrics chart\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"enable-and-configure-the-azure-module\">Enable and configure the Azure module<\/h2>\n\n\n\n<p>Simply run one command which enables the Azure module. This is depicted from the page within Kibana, where we started, as step three.<\/p>\n\n\n\n<p>This will ensure that the <code>azure.yml<\/code> configuration file becomes active, in order to communicate with your Azure subscription.<\/p>\n\n\n\n<p>The command to enabled the module on Linux is:<\/p>\n\n\n\n<p><code>sudo filebeat modules <strong>enable<\/strong> azure<\/code><\/p>\n\n\n\n<p>To list all modules, displaying the enabled ones at the top, run:<\/p>\n\n\n\n<p><code>sudo filebeat modules <strong>list<\/strong><\/code><\/p>\n\n\n\n<p>To disable the module, simply run:<\/p>\n\n\n\n<p><code>sudo filebeat modules <strong>disable<\/strong> azure<\/code><\/p>\n\n\n\n<p>You have to configure the <code>azure.yml<\/code> file after enabling it. On Linux this is typically found under the <code>\/etc\/filebeat\/modules.d<\/code> directory. If a module is not enabled, there will be a <code>.disabled<\/code> extension in that directory as well.<\/p>\n\n\n\n<p>Only the <strong>activitylogs <\/strong>is enabled by default within the Azure module, expressed by <code>enabled: true<\/code>.<\/p>\n\n\n\n<p>In order to configure the <strong>auditlogs<\/strong> and <strong>signinlogs<\/strong>, you must be a global administrator or security administrator of your Azure account. You can refer to the <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/reports-monitoring\/tutorial-azure-monitor-stream-logs-to-event-hub\">instruction on how to export audit and sign-in logs<\/a> to the event hub for more details. You can then enable them by changing the <code>enabled: false<\/code> to <code>true<\/code>.<\/p>\n\n\n\n<p><strong>Important<\/strong>: If you do not have sufficient permissions to configure the audit and sign-in logs, then those modules in the <code>azure.yml<\/code> file must remain disabled.<\/p>\n\n\n\n<p>Time to add the information to <code>azure.yml<code> configuration file. All you need to add is the <code>eventhub<\/code> and <code>connection_string<\/code> entry details saved earlier, and then the storage account details.<\/code><\/code><\/p>\n\n\n\n<p><strong>Pro Tip<\/strong>: The storage account name and key needed can be found from the <strong>Storage account<\/strong> you want to utilize. Click <strong>Access keys<\/strong>. You can also refer to the Microsoft Azure <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/storage\/common\/storage-account-keys-manage?tabs=azure-portal\">Manage storage account access keys<\/a> for help.<\/p>\n\n\n\n<p>Your configuration file, assuming you are only configuring the activity logs, would be similar to the following.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/configuration-file.png\" alt=\"configuration file\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>For more information on this configuration, please refer to the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/filebeat-module-azure.html#_module_configuration_2\">module configuration<\/a> documentation. The <strong>storage account\/key <\/strong>is necessary in order to maintain the sequence of logs should the Filebeat service stop.<\/p>\n\n\n\n<p><strong>Pro tip<\/strong>: The eventhub is the <strong>instance name<\/strong>, rather than the Event Hub Namespace. Event Hub namespaces are the grouping container for multiple event hubs, and you are billed at the namespace level. Refer to the <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/event-hubs\/event-hubs-faq\">Event Hubs FAQ<\/a> on Microsoft\u2019s docs site for more details on this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"setting-up-and-starting-filebeat\">Setting up and starting Filebeat<\/h2>\n\n\n\n<p>Now that Filebeat, an <code>event hub<code>, and storage account have been configured it is time to kick things off by running setup and starting Filebeat.<\/code><\/code><\/p>\n\n\n\n<p>Back on the Kibana page where we started downloading and configuring Filebeat, step four outlines the following commands which are needed at this point.<\/p>\n\n\n\n<p>Because we used RPM to install Filebeat as a service, it must also be used to run it as a service. Depending on the type of system you are using, it could be slightly different. Please refer to the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/current\/running-with-systemd.html\">Filebeat and systemd<\/a> for more details on running Filebeat as a service for DEB and RPM packages, or refer to the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/7.9\/filebeat-installation-configuration.html#setup-assets\">Filebeat quick start<\/a> if running on a different platform.<\/p>\n\n\n\n<p>First we need to run the <code>setup<\/code> step, which will load such things as predefined assets, indexes, and visualizations which are used by the predefined&nbsp;Azure Cloud dashboards. The <code>setup<\/code> command takes advantage of all the out-of-the-box integrations Elastic has with Azure, alleviating the need to develop your own, however, everything is fully customizable and there are many community developed integrations.<\/p>\n\n\n\n<p>Run the setup:<\/p>\n\n\n\n<p><code>sudo filebeat setup<\/code><\/p>\n\n\n\n<p>You can also run the setup command with a -e for which will send logging data to the display, rather than to the syslog, useful to see what steps are being taken.<\/p>\n\n\n\n<p><code>sudo filebeat setup -e<\/code><\/p>\n\n\n\n<p>Then, start the service:<\/p>\n\n\n\n<p><code>sudo service filebeat start<\/code><\/p>\n\n\n\n<p>To check the status:<\/p>\n\n\n\n<p><code>sudo service filebeat status<\/code><\/p>\n\n\n\n<p>To stop Filebeat:<\/p>\n\n\n\n<p><code>sudo service filebeat stop<\/code><\/p>\n\n\n\n<p>To check and validate, with a running dialog, the service is running healthy:<\/p>\n\n\n\n<p><code>sudo journalctl -u filebeat -f<\/code><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"visualizing-in-kibana\">Visualizing in Kibana<\/h2>\n\n\n\n<p>Now that we have the activity logs being collected by the event hub, and, in turn, being sent to Elasticsearch&nbsp; by Filebeat, we can visualize them in Kibana.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2021\/01\/10_Module-status.png\" alt=\"module status\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Assuming you still have the page open where we initiated the Filebeat configuration, you should be able to <strong>Check data<\/strong> and then finally click <strong>Azure logs dashboard<\/strong>, which will take you right to the dashboard<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"conclusion\">Conclusion<\/h2>\n\n\n\n<p>We hope you found this to be a helpful resource for getting started with Filebeat, ingesting Azure activity logs with the use of an event hub.<\/p>\n\n\n\n<p>The next step is to collect your Azure compute, container, database storage, billing, and application insight metrics using the <a href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/metricbeat\/current\/metricbeat-module-azure.html\">Metricbeat Azure module<\/a>.<\/p>\n\n\n\n<p>Have questions or want to contribute to a beneficial discussion? Be sure to check out the <a href=\"https:\/\/discuss.elastic.co\/c\/observability\/82\">Elastic Observability discussion group<\/a>. There are also a number of getting started videos and training resources you can take advantage of by visiting <a href=\"https:\/\/www.elastic.co\/learn\">elastic.co\/learn<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The ability to access the internal state of your application ecosystem is critical to optimizing your applications and the experience of your users.<\/p>\n","protected":false},"author":5562,"featured_media":95465,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"msxcm_post_with_no_image":false,"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","footnotes":""},"post_tag":[2271,1715],"content-type":[340],"topic":[2241],"programming-languages":[],"coauthors":[1718],"class_list":["post-84314","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-community-partners","tag-elastic","content-type-tutorials-and-demos","topic-cloud","review-flag-1593580428-734","review-flag-7-1593580463-151","review-flag-and-o-1593580423-446","review-flag-disab-1706240524-342","review-flag-disab-1706240532-905","review-flag-machi-1680214156-53","review-flag-micro-1680215167-604","review-flag-new-1593580248-669"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to monitor your Azure infrastructure with Filebeat and Elastic Observability | Microsoft Open Source Blog<\/title>\n<meta name=\"description\" content=\"Learn how to ingest Azure activity logs into Elastic Cloud (managed Elasticsearch Service) with our step-by-step guide.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to monitor your Azure infrastructure with Filebeat and Elastic Observability | Microsoft Open Source Blog\" \/>\n<meta property=\"og:description\" content=\"Learn how to ingest Azure activity logs into Elastic Cloud (managed Elasticsearch Service) with our step-by-step guide.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Open Source Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-07T16:09:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-23T18:17:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_037.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1170\" \/>\n\t<meta property=\"og:image:height\" content=\"640\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Aaron M. Schifman\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@OpenAtMicrosoft\" \/>\n<meta name=\"twitter:site\" content=\"@OpenAtMicrosoft\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aaron M. Schifman\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 min read\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/\"},\"author\":[{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/author\\\/aaron-m-schifman\\\/\",\"@type\":\"Person\",\"@name\":\"Aaron M. Schifman\"}],\"headline\":\"How to monitor your Azure infrastructure with Filebeat and Elastic Observability\",\"datePublished\":\"2021-01-07T16:09:22+00:00\",\"dateModified\":\"2025-06-23T18:17:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/\"},\"wordCount\":1663,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/CLO19_Ubisoft_Azure_037.webp\",\"keywords\":[\"Community\\\/partners\",\"Elastic\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/\",\"url\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/\",\"name\":\"How to monitor your Azure infrastructure with Filebeat and Elastic Observability | Microsoft Open Source Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/CLO19_Ubisoft_Azure_037.webp\",\"datePublished\":\"2021-01-07T16:09:22+00:00\",\"dateModified\":\"2025-06-23T18:17:21+00:00\",\"description\":\"Learn how to ingest Azure activity logs into Elastic Cloud (managed Elasticsearch Service) with our step-by-step guide.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#primaryimage\",\"url\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/CLO19_Ubisoft_Azure_037.webp\",\"contentUrl\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/CLO19_Ubisoft_Azure_037.webp\",\"width\":1170,\"height\":640},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/2021\\\/01\\\/07\\\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to monitor your Azure infrastructure with Filebeat and Elastic Observability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/\",\"name\":\"Microsoft Open Source Blog\",\"description\":\"Open dialogue about openness at Microsoft \u2013 open source, standards, interoperability\",\"publisher\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#organization\",\"name\":\"Microsoft Open Source Blog\",\"url\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/08\\\/Microsoft-Logo.png\",\"contentUrl\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/08\\\/Microsoft-Logo.png\",\"width\":259,\"height\":194,\"caption\":\"Microsoft Open Source Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/opensource.microsoft.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/OpenAtMicrosoft\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to monitor your Azure infrastructure with Filebeat and Elastic Observability | Microsoft Open Source Blog","description":"Learn how to ingest Azure activity logs into Elastic Cloud (managed Elasticsearch Service) with our step-by-step guide.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/","og_locale":"en_US","og_type":"article","og_title":"How to monitor your Azure infrastructure with Filebeat and Elastic Observability | Microsoft Open Source Blog","og_description":"Learn how to ingest Azure activity logs into Elastic Cloud (managed Elasticsearch Service) with our step-by-step guide.","og_url":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/","og_site_name":"Microsoft Open Source Blog","article_published_time":"2021-01-07T16:09:22+00:00","article_modified_time":"2025-06-23T18:17:21+00:00","og_image":[{"width":1170,"height":640,"url":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_037.png","type":"image\/png"}],"author":"Aaron M. Schifman","twitter_card":"summary_large_image","twitter_creator":"@OpenAtMicrosoft","twitter_site":"@OpenAtMicrosoft","twitter_misc":{"Written by":"Aaron M. Schifman","Est. reading time":"7 min read"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#article","isPartOf":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/"},"author":[{"@id":"https:\/\/opensource.microsoft.com\/blog\/author\/aaron-m-schifman\/","@type":"Person","@name":"Aaron M. Schifman"}],"headline":"How to monitor your Azure infrastructure with Filebeat and Elastic Observability","datePublished":"2021-01-07T16:09:22+00:00","dateModified":"2025-06-23T18:17:21+00:00","mainEntityOfPage":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/"},"wordCount":1663,"commentCount":0,"publisher":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#organization"},"image":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#primaryimage"},"thumbnailUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_037.webp","keywords":["Community\/partners","Elastic"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/","url":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/","name":"How to monitor your Azure infrastructure with Filebeat and Elastic Observability | Microsoft Open Source Blog","isPartOf":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#primaryimage"},"image":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#primaryimage"},"thumbnailUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_037.webp","datePublished":"2021-01-07T16:09:22+00:00","dateModified":"2025-06-23T18:17:21+00:00","description":"Learn how to ingest Azure activity logs into Elastic Cloud (managed Elasticsearch Service) with our step-by-step guide.","breadcrumb":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#primaryimage","url":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_037.webp","contentUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_037.webp","width":1170,"height":640},{"@type":"BreadcrumbList","@id":"https:\/\/opensource.microsoft.com\/blog\/2021\/01\/07\/how-to-monitor-azure-infrastructure-filebeat-elastic-observability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/opensource.microsoft.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to monitor your Azure infrastructure with Filebeat and Elastic Observability"}]},{"@type":"WebSite","@id":"https:\/\/opensource.microsoft.com\/blog\/#website","url":"https:\/\/opensource.microsoft.com\/blog\/","name":"Microsoft Open Source Blog","description":"Open dialogue about openness at Microsoft \u2013 open source, standards, interoperability","publisher":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/opensource.microsoft.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/opensource.microsoft.com\/blog\/#organization","name":"Microsoft Open Source Blog","url":"https:\/\/opensource.microsoft.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/opensource.microsoft.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2019\/08\/Microsoft-Logo.png","contentUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2019\/08\/Microsoft-Logo.png","width":259,"height":194,"caption":"Microsoft Open Source Blog"},"image":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/OpenAtMicrosoft"]}]}},"msxcm_animated_featured_image":null,"bloginabox_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Open Source Blog","distributor_original_site_url":"https:\/\/opensource.microsoft.com\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts\/84314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/users\/5562"}],"replies":[{"embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/comments?post=84314"}],"version-history":[{"count":1,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts\/84314\/revisions"}],"predecessor-version":[{"id":97610,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts\/84314\/revisions\/97610"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/media\/95465"}],"wp:attachment":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/media?parent=84314"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/post_tag?post=84314"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/content-type?post=84314"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/topic?post=84314"},{"taxonomy":"programming-languages","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/programming-languages?post=84314"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/coauthors?post=84314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}