Configure Azure Event Hubs for logs

Complete the following steps to configure Azure Event Hubs as shown in the following diagram.

Select your platform

Select the platform from the drop-down menu.

Install Grafana Alloy

Click Run Grafana Alloy to open steps to set up Grafana Alloy and create a configuration file.

If you have not already installed Alloy where you intend to run Azure Event Hubs, click Run Grafana Alloy.
At the Alloy configuration screen, either create a token or use an existing token.
1. To create a token, enter a token name, then click Create token. The token displays on the screen and is added to the command for running Alloy. Copy the command and paste it into the terminal.
2. To use an existing token, paste it into the token field, then click Proceed to install integration.
Copy the command and paste it into the terminal.
Click Proceed to install integration.

Set up Azure Event Hubs

Grafana Alloy consumes events from Azure Event Hub using Apache Kafka endpoint.

Click Setup instructions.
At the Set up Azure Event Hubs screen, use these steps in the Azure portal to start Event Hubs and route logs from the Function App.

Create a namespace

Complete the following steps in the Azure portal, and use the example command for each step.

Step	Example command
1. Log in to your Azure account with the command.	`az login`
2. List your available subscriptions.	`az account list --output table`
3. Select the subscription that you want to use by replacing `subscription-id` with the appropriate value.	`az account set --subscription <subscription-id>`
3. Create an Azure Event Hubs namespace.	`az eventhubs namespace create --resource-group <resource-group-name> --name <namespace-name> --location <location> --sku <sku> --enable-kafka true` Replace the following with your own values: `resource-group-name`, `namespace-name`, `location`, and `sku`. If you want to enable Kafka, set `sku` to either `Standard` or `Premium`.
4. Create an Event Hub within the namespace you created.	`az eventhubs eventhub create --resource-group <resource-group-name> --namespace-name <namespace-name> --name <eventhub-name>` Replace the following with your own values: `resource-group-name`, `namespace-name`, and `eventhub-name`.
5. Create a shared access policy for listening to events. This command creates a policy with the “Listen” permission.	`az eventhubs namespace authorization-rule create --name <rule_name> --resource-group <resource-group-name> --namespace-name <namespace-name> --rights Listen` Replace the following with your own values: `rule_name`, `resource-group-name`, `namespace-name`, and `policy-name`.
6. Output the connection string value for your Event Hub. You need the string value to configure Alloy so it can receive your logs. Note: Save this value in a secure location. It can be used to access all your event hubs within a namespace.	`az eventhubs namespace authorization-rule keys list --resource-group <resource-group-name> --namespace-name <namespace-name> --name <policy-name> --query primaryConnectionString --output tsv` Replace the following with your own values: `resource-group-name`, `namespace-name`, and `policy-name`.

Configure your resources to route logs to Event Hub

Configure your resources to route logs to the event hub. This allows you to set up a diagnostic settings configuration for one or more resources. These resources then route logs to your newly created event hub. Complete the following steps in the Azure portal, then click Close to return to the next step.

Navigate to Azure Monitor.
Under Settings, click Diagnostic settings.
Click the resource you want to route logs from.
Click + Add diagnostic setting to add a new diagnostic setting.
Under Logs -> Categories, select options for the logs you want.
Under Destination details:
1. Select Stream to an event hub as the destination.
2. Choose the event hub namespace and the event hub name you previously created.
Click Save to save your diagnostic setting. Your resource begins sending logs to the specified event hub.

Configure Alloy

Set up Grafana Alloy to get events from Azure Event Hub.

Navigate to the configuration file for your Alloy instance.
Copy and append the following to your Alloy configuration file so that Grafana Alloy can scrape your Azure Event Hub instances.

discovery.relabel "logs_integrations_integrations_azure_event_hubs" {
  targets = []

  rule {
    source_labels = ["__meta_kafka_topic"]
    target_label  = "topic"
  }
}

loki.source.azure_event_hubs "logs_integrations_integrations_azure_event_hubs" {
  fully_qualified_namespace = "<fully_qualified_namespace>"
  event_hubs                = ["<event_hub_name>"]

  authentication {
    mechanism         = "connection_string"
    connection_string = "<connection_string>"
  }
  use_incoming_timestamp = true
  relabel_rules          = discovery.relabel.logs_integrations_integrations_azure_event_hubs.rules
  labels                 = {
    job = "integrations/azure_event_hubs",
  }
  forward_to = [loki.write.grafana_cloud_loki.receiver]
}

Find or create connection string

Find or create a connection-string for authentication on Azure.

In the Azure portal, navigate to Event Hubs.
To find an existing string related to an existing access policy, click Shared access policies under Settings.
To create a new shared access policy:
1. Click +.
2. Give your policy a name.
3. Select, at a minimum, the Listen permission. If you want to create another policy, click Create.
View the primary and secondary connection strings for your policy under Shared access keys.
Copy the connection string you want to use.

Add connection string to configuration file

Add the connection string to your Alloy configuration file along with the name of the Event Hub. You can specify multiple Event Hubs.

Paste the connection string you previously copied into the configuration file.
Specify the Event Hub to consume by replacing event_hub_name with your value.
This argument must refer to a full HOST:PORT that points to your event hub. For example: <namespace>.servicebus.windows.net:9093. The namespace is the name of your Event Hubs namespace, specified when you create the namespace. Later, it can be found in the Azure portal on the Event Hubs Namespace dashboard.