Send logs to Azure Blob Storage

Create a stream that writes the logs of your applications to an Azure Blob Storage container, in Azion Console or with the Azion API, and confirm the delivery.

Last updated

View as Markdown Agent setup

You can send the logs of a stream to an Azure Blob Storage container from Azion Console or with the Azion API. To send them to a workspace in Azure Monitor instead, refer to Send logs to Azure Monitor.

Data Stream writes the log lines to a container of your Azure storage account. The stream form sets the endpoint in the field labeled Connector, where Azure Blob Storage is the Azure Blob Storage option. For every field and its bounds, refer to Endpoints.

The example collects the requests of one workload with the Applications data source.

Select your interface once. The prerequisites and every task below show only that path.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • A workload on the account that receives requests.
  • An Azure storage account and its name, such as mystorageaccount.
  • A container in the storage account. The container must exist before the stream sends to it.
  • A shared access signature (SAS) token for the container, with the create, read, write, and list permissions.

Create the stream

A workload filter selects the workload the stream collects from. Your other streams stay active, which is not the case with sampling.

To create the stream with the API, send a POST request to https://api.azion.com/v4/workspace/stream/streams. Replace [TOKEN VALUE] with your personal token, <workload-id> with the ID of your workload, and the storage values with your own:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "logs-to-azure-blob",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "workloads" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 2 } }
13 ],
14 "outputs": [
15 {
16 "type": "azure_blob_storage",
17 "attributes": {
18 "storage_account": "mystorageaccount",
19 "container_name": "azion-logs",
20 "blob_sas_token": "[SAS TOKEN]"
21 }
22 }
23 ]
24 }

The workloads data source is Applications in the Console, and template 2 is Applications Event Collector. The API answers 201 with the stored stream:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": 12357,
05 "name": "logs-to-azure-blob",
06 "last_editor": "user@example.com",
07 "created": "2026-01-01T12:10:44.000000Z",
08 "last_modified": "2026-01-01T12:10:44.000000Z",
09 "product_version": "1.0",
10 …
11 "outputs": [
12 {
13 "type": "azure_blob_storage",
14 "attributes": {
15 "storage_account": "mystorageaccount",
16 "container_name": "azion-logs",
17 "blob_sas_token": "[SAS TOKEN]"
18 }
19 }
20 ]
21 }
22}

The id identifies the stream in every later request, such as /v4/workspace/stream/streams/12357. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: logs-to-azure-blob.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. Select your workload in Available Workload, then use the arrow to move it to Chosen Workload.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the Azure Blob Storage endpoint

In the Output section, select Azure Blob Storage in Connector.

Enter the container location

Enter the name of the storage account in Storage Account, such as mystorageaccount. Enter the name of the container in Container Name, such as azion-logs.

Enter the SAS token

Paste the SAS token of the container in Blob SAS Token.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The Data Stream list shows the stream with Azure Blob Storage in the Connector column and the Active status.

Neither the API nor the Console contacts the container when it saves the stream. A wrong storage account, container name, or SAS token appears only when the stream sends. An activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events records every send of a stream, with the status code the endpoint returned, whether the send succeeds or fails. Send a few requests to the workload, then wait about a minute. A stream sends a batch every 60 seconds, or earlier when the batch reaches 2,000 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Replace the dates with a range that starts at the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T12:00:00\", end: \"2026-01-01T12:45:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record for each send, the latest first:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:02:04Z",
06 "endpointType": "AZURE_BLOB_STORAGE",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A send to Azure Blob Storage carries AZURE_BLOB_STORAGE in endpointType. A statusCode of 200 means the container accepted the batch of streamedLines log lines and dataStreamed bytes. An empty dataStreamedEvents list means the stream has not sent in the range. For every field, refer to Real-Time Events GraphQL fields.

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Read the latest sends

Each row is one send. Find the rows with AZURE_BLOB_STORAGE in Endpoint Type, and read their Status Code.

A Status Code of 200 means the container accepted the batch. Streamed Lines gives the number of log lines in the batch.

A status other than 200 comes from the endpoint, except 503, which means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

Next steps

EndpointsEvery field of the Azure Blob Storage endpoint, with its type, bounds, and API name.Send logs to Azure MonitorSend the logs to a workspace in Azure Monitor instead of a container.Edit, stop, or delete a streamChange the container or the SAS token, pause the stream, or remove it.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.