azure-monitor-ingestion 1.0.0b1

Microsoft Azure Monitor Ingestion Client Library for Python

Azure Monitor Ingestion client library for Python

The Azure Monitor Ingestion client library is used to send custom logs to Azure Monitor.

This library allows you to send data from virtually any source to supported built-in tables or to custom tables that you create in Log Analytics workspace. You can even extend the schema of built-in tables with custom columns.

Resources:

• Source code
• Package (PyPI)
• API reference documentation
• Service documentation
• Samples
• Change log

Disclaimer

Azure SDK Python packages support for Python 2.7 has ended on 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691

Getting started

Prerequisites

• Python 3.6 or later
• An Azure subscription
• An [Azure Log Analytics workspace][azure_monitor_create_using_portal].
• A Data Collection Endpoint
• A Data Collection Rule

Install the package

Install the Azure Monitor Ingestion client library for Python with pip:

pip install azure-monitor-ingestion

Create the client

An authenticated client is required to upload Logs to Azure Monitor. The library includes both synchronous and asynchronous forms of the clients. To authenticate, create an instance of a token credential. Use that instance when creating a LogsIngestionClient. The following examples use DefaultAzureCredential from the azure-identity package.

Synchronous clients

Consider the following example, which creates synchronous clients for uploading logs:

import os
from azure.identity import DefaultAzureCredential
from azure.monitor.ingestion import LogsIngestionClient

endpoint = os.environ['DATA_COLLECTION_ENDPOINT']
credential = DefaultAzureCredential()
logs_client = LogsIngestionClient(endpoint, credential)

Asynchronous clients

The asynchronous forms of the client APIs are found in the .aio-suffixed namespace. For example:

import os
from azure.identity.aio import DefaultAzureCredential
from azure.monitor.ingestion.aio import LogsIngestionClient

endpoint = os.environ['DATA_COLLECTION_ENDPOINT']
credential = DefaultAzureCredential()
logs_client = LogsIngestionClient(endpoint, credential)

Key concepts

Data Collection Endpoint

Data Collection Endpoints (DCEs) allow you to uniquely configure ingestion settings for Azure Monitor. This article provides an overview of data collection endpoints including their contents and structure and how you can create and work with them.

Data Collection Rule

Data collection rules (DCR) define data collected by Azure Monitor and specify how and where that data should be sent or stored. The REST API call must specify a DCR to use. A single DCE can support multiple DCRs, so you can specify a different DCR for different sources and target tables.

The DCR must understand the structure of the input data and the structure of the target table. If the two don't match, it can use a transformation to convert the source data to match the target table. You may also use the transform to filter source data and perform any other calculations or conversions.

For more details, refer to Data collection rules in Azure Monitor.

Log Analytics Workspace Tables

Custom logs can send data to any custom table that you create and to certain built-in tables in your Log Analytics workspace. The target table must exist before you can send data to it. The following built-in tables are currently supported:

• CommonSecurityLog
• SecurityEvents
• Syslog
• WindowsEvents

Examples

• Upload custom logs

Upload custom logs

This example shows uploading logs to Azure monitor.

import os
from azure.monitor.ingestion import LogsIngestionClient, UploadLogsStatus
from azure.identity import DefaultAzureCredential

endpoint = os.environ['DATA_COLLECTION_ENDPOINT']
credential = DefaultAzureCredential()

client = LogsIngestionClient(endpoint=endpoint, credential=credential, logging_enable=True)

rule_id = os.environ['LOGS_DCR_RULE_ID']
body = [
      {
        "Time": "2021-12-08T23:51:14.1104269Z",
        "Computer": "Computer1",
        "AdditionalContext": "context-2"
      },
      {
        "Time": "2021-12-08T23:51:14.1104269Z",
        "Computer": "Computer2",
        "AdditionalContext": "context"
      }
    ]

response = client.upload(rule_id=rule_id, stream_name=os.environ['LOGS_DCR_STREAM_NAME'], logs=body)
if response.status != UploadLogsStatus.SUCCESS:
    failed_logs = response.failed_logs_index
    print(failed_logs)

Troubleshooting

Enable the azure.monitor.ingestion logger to collect traces from the library.

General

Monitor Ingestion client library will raise exceptions defined in Azure Core.

Logging

This library uses the standard logging library for logging. Basic information about HTTP sessions, such as URLs and headers, is logged at the INFO level.

Optional configuration

Optional keyword arguments can be passed in at the client and per-operation level. The azure-core reference documentation describes available configurations for retries, logging, transport protocols, and more.

Next steps

To learn more about Azure Monitor, see the Azure Monitor service documentation.

Samples

The following code samples show common scenarios with the Azure Monitor Ingestion client library.

Logs Ingestion samples

• Upload a list of logs (async sample)

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repositories using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [e-mail] with any additional questions or comments.

Release History

1.0.0b1 (2022-07-15)

Features

• Version (1.0.0b1) is the first preview of our efforts to create a user-friendly and Pythonic client library for Azure Monitor Ingestion. For more information about this, and preview releases of other Azure SDK libraries, please visit https://azure.github.io/azure-sdk/releases/latest/python.html.
• Added ~azure.monitor.ingestion.LogsIngestionClient to send logs to Azure Monitor along with ~azure.monitor.ingestion.aio.LogsIngestionClient.