Loading

Deploy EDOT Cloud Forwarder for Azure

Follow these steps to deploy EDOT Cloud Forwarder for Azure in a resource group to send telemetry data to the Elastic Cloud Managed OTLP Endpoint endpoint.

Before you deploy EDOT Cloud Forwarder for Azure, consider these points:

  • The logs event hub supports Azure resource logs.
  • Support for additional encoding extensions for logs and metrics will be added in future releases.

You can deploy EDOT Cloud Forwarder for Azure automatically by clicking the Deploy to Azure button:

Deploy to Azure

This opens the Azure portal with the Bicep template pre-filled. You can then configure the parameters and deploy the template. The template is also available at the following URL: https://ela.st/edot-cf-azure-template

  1. Create the resource group

    Create the resource group that hosts all the resources for EDOT Cloud Forwarder for Azure.

    az group create --name <resource_group_name> --location <azure_region>

  2. Download the Bicep template

    Download the Bicep template to deploy EDOT Cloud Forwarder for Azure at the following URL: https://ela.st/edot-cf-azure-template

  3. Deploy the Bicep template

    Deploy the Bicep template using the following command:

    az deployment group create \
    --resource-group <resource_group_name> \
    --template-file ecf.bicep \
    --parameters \
        otlpEndpoint=<otlp_endpoint> \
        elasticApiKey=<elastic_api_key> \
    1. The OTLP endpoint is the URL of the Elasticsearch OTLP endpoint. Refer to Prerequisites.
    2. The Elastic API key is the API key for authentication. Refer to Prerequisites.

    For a complete list of parameters, refer to Configure EDOT Cloud Forwarder for Azure.

Follow these instructions to collect telemetry data depending on your use case.

Create a diagnostic setting to collect Activity logs from an Azure subscription.

  1. In the Azure portal, open Subscriptions from the search bar.
  2. Select the Azure subscription from which you want to collect Activity logs.
  3. Go to Activity log → Export Activity Logs → Add diagnostic setting.
    • In Diagnostic setting name, enter a name for the diagnostic setting.
    • Select all categories in Logs > Administrative.
    • In Destination details, select Stream to an event hub.
    • In Event hub namespace, select the namespace created by the EDOT Cloud Forwarder (ECF) for Azure.
    • In Event hub name (optional), select the logs event hub created by the EDOT Cloud Forwarder (ECF) for Azure.
  4. Select Save to create the diagnostic setting.
  5. After a few minutes, the diagnostic setting starts streaming the Activity logs to the logs event hub.
  6. Go to Discover in your Elastic Cloud deployment or Serverless project, and select the logs-* data view.
  7. Filter the docs by data_stream.dataset, to browse the Activity logs streamed to Elasticsearch.

To upgrade an existing EDOT Cloud Forwarder for Azure deployment to a newer version, refer to Upgrade EDOT Cloud Forwarder for Azure.

If you no longer need the resources and want to remove them, use the following command:

az group delete --name <resource_group_name>

This removes all the resources in the resource group.

Warning

If you remove the resource group, data that's still unprocessed will be lost.