Anyone connected Vector to Azure Log Analytics Workspace

[Idriel]

Hi,
has anyone connected vector with azure_monitor_logs, I don't get any errors when watching Vector top but log does not show in custom table.
anyone have some cookbook how to configure log analytics workspace and vector to work?

[Idriel]

Looks like vector is using old/legacy API and not supporting new Data ingestion with Data Collection Rules (DCRs)

[pront]

Vector now has an azure_logs_ingestion sink for the DCR-based API.

Microsoft's Logs Ingestion API setup guide covers the Azure side: create the custom table and DCR, then grant the sending identity the Monitoring Metrics Publisher role on that DCR. The events must match the DCR's input stream schema.

For a local test using an already signed-in Azure CLI:

sinks:
  azure:
    type: azure_logs_ingestion
    inputs: [your_source_or_transform]
    endpoint: https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com
    dcr_immutable_id: dcr-000a00a000a00000a000000aa000a0aa
    stream_name: Custom-MyTable
    auth:
      azure_credential_kind: azure_cli

Use your ingestion endpoint, DCR immutable ID, and stream name from Azure. The sink also supports managed identity and workload identity for deployed workloads.

This configuration passed validation on Vector 0.60.0; I haven't tested delivery to an Azure workspace.