Skip to content
Osuite Osuite Docs

Collect Azure logs in Osuite

Overview

Section titled “Overview”

Azure exports platform, resource, and activity logs through diagnostic settings that stream to an Azure Event Hub. The OpenTelemetry Collector’s azure_event_hub receiver consumes that hub, converts each record to OTLP, and forwards it to Osuite through the otlp/osuite exporter, where it correlates with the rest of your telemetry.

Prerequisites

Section titled “Prerequisites”
  • An OpenTelemetry Collector from the Contrib distribution (otelcol-contrib) that includes the azure_event_hub receiver.
  • Your Osuite ingest endpoint and token.
  • An Event Hubs namespace and an event hub for the Collector to read.
  • A diagnostic setting on each resource (or at subscription level for activity logs) that streams the log categories you want to the event hub: in the Azure portal, open the resource → Diagnostic settings → Add diagnostic setting → select log categories → Stream to an event hub.
  • A shared access policy on the event hub with Listen permission; copy its connection string. It must end with ;EntityPath=<hub-name>.

Collector config

Section titled “Collector config”

This configuration reads one event hub and forwards its log records to Osuite. Replace the connection string with your own — keep the EntityPath suffix.

receivers:
  azure_event_hub:
    connection: Endpoint=sb://<namespace>.servicebus.windows.net/;SharedAccessKeyName=<policy-name>;SharedAccessKey=<key>;EntityPath=<hub-name>
    group: $Default
    format: azure


processors:
  batch:


exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>


service:
  pipelines:
    logs:
      receivers: [azure_event_hub]
      processors: [batch]
      exporters: [otlp/osuite]

format: azure (the default) parses the Azure resource-log envelope, mapping the timestamp, severity, category, and resource ID onto each record. group is the consumer group; $Default works unless you created a dedicated one. To keep the connection string out of the config file, set the receiver’s connection from an environment variable with ${env:AZURE_EVENTHUB_CONNECTION}.

Verify in Osuite

Section titled “Verify in Osuite”

What you should see

Azure log records appear in the Logs Explorer within a minute or two, tagged with their resource ID, category, and severity. Filtering by cloud.provider = azure isolates them.

Troubleshooting

Section titled “Troubleshooting”

An empty result usually means the diagnostic setting is not actually streaming to the hub, or the connection string lacks Listen rights or the EntityPath suffix. Confirm the event hub is receiving messages in the portal’s Messages chart, confirm the shared access policy has Listen, and check the Collector logs for authentication or EntityPath errors. If multiple Collectors read the same hub, give each its own consumer group.

No data in Osuite after a few minutes? Work through these checks.

  • Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
  • Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
  • Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
  • Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
  • Network — confirm the host has outbound access to the ingest endpoint on port 443.
  • Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.

Next steps

Section titled “Next steps”