A user running the Azure Logs integration reported that their Agent wasn't able to ingest any data from Microsoft Entra ID.
The agent was running behind a firewall, and they added the rules to allow the AMQP traffic on ports 5671 and 5672.
However, AMQP ports are not enough: the azure-eventhub also access the storage account container service to store checkpoint information for each event hub partition in a blob.
┌────────────────────────────────────────────┐ ┌──────────────────────┐ ┌────────────────────────┐
│ │ │ │ │ │
│ ┌────────────────┐ ┌─────────────────┐ │ │ ┌────────────────┐ │ │ ┌────────────────┐ │
│ │ diagnostic │ │ event hub │ │ │ │ azure-eventhub │ │ │ │ activity logs │ │
│ │ setting │────▶│ │◀┼AMQP──│ <<input>> │──┼───┼───▶│<<data stream>> │ │
│ └────────────────┘ └─────────────────┘ │ │ └────────────────┘ │ │ └────────────────┘ │
│ │ │ │ │ │ │
│ │ │ │ │ │ │
│ │ │ │ │ │ │
│ ┌─────────────┬─────HTTPS───┼───┼───────────┘ │ │ │
│ ┌──────────┼─────────────┼─────────┐ │ │ │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ ▼ ▼ │ │ └─Agent────────────────┘ └─Elastic Cloud──────────┘
│ │ ┌──────────┐ ┌──────────┐ │ │
│ │ │ 0 │ │ 1 │ │ │
│ │ │ <<blob>> │ │ <<blob>> │ │ │
│ │ └──────────┘ └──────────┘ │ │
│ │ │ │
│ │ │ │
│ └─Storage Account container────────┘ │
│ │
│ │
└─Azure──────────────────────────────────────┘
We need to document the firewall setting to allow the azure-eventhub input to successfully connect to the Event Hub and Storage Account services.
### Tasks
- [ ] https://github.com/elastic/integrations/pull/9158
A user running the Azure Logs integration reported that their Agent wasn't able to ingest any data from Microsoft Entra ID.
The agent was running behind a firewall, and they added the rules to allow the AMQP traffic on ports
5671and5672.However, AMQP ports are not enough: the
azure-eventhubalso access the storage account container service to store checkpoint information for each event hub partition in a blob.We need to document the firewall setting to allow the
azure-eventhubinput to successfully connect to the Event Hub and Storage Account services.