Azure Log Analytics Log Writer

Overview

The Azure Log Analytics logger can be used to send log entries to a specific Azure Log Analytics workspace.

Sent entries will contain the message of individual logs as a JSON formatted message, with information about the source and severity in the base JSON attributes.

Considerations

Use of this logger is encouraged without a log filter in order to take advantage of the powerful indexing and search tools provided by Azure Log Analytics.

Configuration

The Azure Log Analytics log writer requires the following by way of configuration:

Attribute	Supports References	Description
Name	no	The display name of the log writer which is used for identification throughout UNIFYConnect.
Writer Type	no	The type of the writer to use.Legacy uses the HTTP Data Collector API. DCR uses Data Collection Rules through the Logs Ingestion API.
Workspace ID	yes	The workspace ID of the Azure Log Analytics workspace.Required if Writer Type is set to Legacy
Shared Key	yes	The shared key allows access to the workspace.Required if Writer Type is set to Legacy
Log Type	yes	The log type to use.Required if Writer Type is set to Legacy
Data Collection Endpoint	yes	The Data Collection Endpoint URI for Azure Log Analytics.Required if Writer Type is set to DCR
Data Collection Rule ID	yes	The Data Collection Rule ID for Azure Log Analytics.Required if Writer Type is set to DCR
Data Collection Stream Name	yes	The Data Collection Stream Name for Azure Log Analytics.Required if Writer Type is set to DCR
Auth Client ID	yes	The Client ID for Azure Log Analytics authentication.Required if Writer Type is set to DCR
Auth Client Secret	yes	The Client Secret for Azure Log Analytics authentication.Required if Writer Type is set to DCR
Auth Tenant ID	yes	The Tenant ID for Azure Log Analytics authentication.Required if Writer Type is set to DCR

Azure Log Analytics Log Writer (DCR) Setup Guide

The steps required to set up a DCR log writer are as follows:

1. Create a Microsoft Entra App Registration / Service Principal
2. Create Data Collection Endpoint (DCE)
3. Create a custom table in LAW (DCR-based). Data Collection Rule (DCR) (can be reused for multiple UNIFY tables)
4. Role assignment on the DCR for that service principal
5. Configure Azure Log Analytics Log Writer for use with DCR API.

Prerequisites

• A Log Analytics workspace
• Ensure you have at least contributor rights to create DCE/DCR/table resources in that workspace.

Create a Microsoft Entra App Registration

Create an Application registration to authenticate against the API

• In Azure Portal, on the Microsoft Entra ID menu, select App registration > New Registration.
  

• Fill in the application name; no need for a Redirect URI.
  

• After registering the application, take note of the Application (client) ID and the Directory (tenant) ID, which we will need when setting up the log writer.

• Generate the application client secret, and take note of the secret value.Select Certificates & secrets > New client secret
  

Create Data Collection Endpoint (DCE)

• Create the data collection endpoint by selecting Monitor > Data Collection Endpoint > Create
  

• After the creation, take note of the Logs Ingestion from the overview page.
  

Create a custom table in the Log analytics workspace (DCR-based)

• On the Log Log Analytics workspaces menu, Select Tables > New custom log (DCR based)
  

• Enter the table's name, and select Create a new data collection rule.
  

• Select the Data collection endpoint that we created previously and select Next.
  

• Now, we need to upload a file with a sample JSON of what a typical log entry from Unify Connect looks like. This will allow Azure to infer and configure the table schema.Use the JSON sample below of a log entry.
  

  {
      "timeStamp": "2024-10-03T03:24:58.5977905Z",
      "source": "UNIFYBroker",
      "module": "Connector engine",
      "severity": "Information",
      "message": "Request to get the enabled state of the selected connector.",
      "level": "Verbose",
      "data": {}
  }

• After successfully uploading the JSON sample, we need to add a transformation to create a TimeGenerated mapping it from our JSON payload. Select Transformation Editor

• Add the following transformation and select Run to run the transformation, and then select

  source | extend TimeGenerated = timeStamp

• Select Create to finalize the table creation
• Now, the new DCR can be found listed under Monitor > Data Collection Rules. Take note of the immutable DCR ID as it is used to set up the log writer.
  

Role assignment on the DCR for that service principal

Now, we need to give the application permission to use the DCR, so that our log writer can send data to the new DCE and DCR.

• From Monitor > Data Collection Rules, go to the new DCR page and select Access Control (IAM) > Add role assignment.
  

• Select Monitoring Metrics Publisher > Next
  

• Select User, group, or service principal for Assign access to, and select Select members. Add the application that we previously created.
  

• Review and assign the application role.
  

Configure Azure Log Analytics Log Writer for use with DCR API

• Configure the log writer in Unify Connect and set Log Analytics Writer Type to DCR API.

• Set the DCE logs ingestion URLfound in the DCE overview page to Data Collection Endpoint.

• Set theImmutable ID)of the DCR to the Data Collection Rule ID.

• Set the DCR stream name. This can be found in the Azure portal on the DCR page under Data Sources, then choose the data source name corresponding to the workspace table to be used for logging.
  

• Set the **Auth Client ID, Auth Client Secret, and Auth Tenant ID found in the application registration overview page.

Microsoft reference

• https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal