Send logs to Azure Monitor

Create a stream that sends the logs of your applications to an Azure Monitor workspace, in Azion Console or with the Azion API, and confirm the delivery.

Last updated

View as Markdown Agent setup

You can send the logs of a stream to an Azure Monitor workspace from Azion Console or with the Azion API. To write the logs as files in an Azure storage container instead, refer to Send logs to Azure Blob Storage.

Data Stream sends each batch of log lines to the workspace, which stores them in the table that Log Type names. In the stream form, the endpoint is set in the field labeled Connector, and the Azure Monitor option selects this endpoint. For every field and its bounds, refer to Endpoints.

The example collects the requests of one workload with the Applications data source.

Select your interface once. The prerequisites and every task below show only that path.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • A workload on the account that receives requests.
  • An Azure account with a Log Analytics workspace, added to Microsoft Sentinel.
  • The Workspace ID and the Primary Key of the workspace. The workspace shows both under Agents Management. The Primary Key is the credential of the stream.

Create the stream

The stream collects from the workload you choose, through a workload filter. A workload filter keeps your other streams active, which sampling does not.

To create the stream with the API, send a POST request to https://api.azion.com/v4/workspace/stream/streams. Replace [TOKEN VALUE] with your personal token, <workload-id> with the ID of your workload, and the workspace values with your own:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "logs-to-azure-monitor",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "workloads" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 2 } }
13 ],
14 "outputs": [
15 {
16 "type": "azure_monitor",
17 "attributes": {
18 "log_type": "AzionLogs",
19 "shared_key": "[SHARED KEY]",
20 "workspace_id": "[WORKSPACE ID]",
21 "time_generated_field": "time"
22 }
23 }
24 ]
25 }

The workloads data source is Applications in the Console, and template 2 is Applications Event Collector. The API answers 201 with the stored stream:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": 12356,
05 "name": "logs-to-azure-monitor",
06 "last_editor": "user@example.com",
07 "created": "2026-01-01T12:10:42.000000Z",
08 "last_modified": "2026-01-01T12:10:42.000000Z",
09 "product_version": "1.0",
10 …
11 "outputs": [
12 {
13 "type": "azure_monitor",
14 "attributes": {
15 "log_type": "AzionLogs",
16 "shared_key": "[SHARED KEY]",
17 "time_generated_field": "time",
18 "workspace_id": "[WORKSPACE ID]"
19 }
20 }
21 ]
22 }
23}

Keep the id: it identifies the stream in every later request, such as /v4/workspace/stream/streams/12356. The time_generated_field key is optional: omit it to use the ingestion time. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: logs-to-azure-monitor.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. In Available Workload, select your workload and move it to Chosen Workload with the arrow.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the Azure Monitor endpoint

In the Output section, select Azure Monitor in Connector.

Enter the log type

In Log Type, enter the name of the table that stores the logs. For example: AzionLogs. Use only letters, numbers, and the underscore _, up to 100 characters.

Enter the workspace credential

Enter the Primary Key of the workspace in Shared Key and its ID in Workspace ID. The Console masks Shared Key.

(Optional) Enter the time generated field

In Time Generated Field, enter a value such as myCustomTimeField. Leave it empty to use the ingestion time.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The stream appears in the Data Stream list with Azure Monitor in the Connector column and the Active status.

The API and the Console save the stream without contacting the workspace. A wrong workspace ID or key surfaces only when the stream sends. An activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload, then wait about a minute: a stream sends a batch every 60 seconds, or sooner when it reaches 2,000 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Replace the dates with a range that covers the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T12:00:00\", end: \"2026-01-01T12:45:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record for each send, the latest first:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:02:04Z",
06 "endpointType": "AZURE_MONITOR",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A send to Azure Monitor carries AZURE_MONITOR in endpointType. A statusCode of 200 means the endpoint accepted the batch of streamedLines log lines and dataStreamed bytes. An empty dataStreamedEvents list means the stream has not sent in the range. For every field, refer to Real-Time Events GraphQL fields.

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Read the latest sends

Each row is one send. Find the rows with AZURE_MONITOR in Endpoint Type, and read their Status Code.

A Status Code of 200 means the workspace accepted the batch. Streamed Lines gives the number of log lines in the batch.

A status other than 200 is the answer of the endpoint, and 503 means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

In Azure, open the Logs section of the workspace and query the table that Log Type names. Its records are the log lines of the stream.

Next steps

EndpointsEvery field of the Azure Monitor endpoint, with its type, bounds, and API name.Send logs to Azure Blob StorageWrite the logs as files in an Azure storage container.Edit, stop, or delete a streamChange the workspace or the key, pause the stream, or remove it.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.