This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 54%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENL%3C/text%3E%3C/svg%3E)
I had catch VM logs（such as windows event & linux syslog）with azure monitor agent，and the logs store in Log Analytics Workspace
Then，i want to sent the logs form Log Analytics Workspace to eventhub use logicapp workflow， some problem happen as no log can received by eventhub
I don't know if there is enough information here to formulate a response but I would use data export.
Have you considered using Data Export instead?
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export
Thanks Andrew,
I considered using logicapp because I would eventually configure it in Azure 21v, and Azure 21v Log Analytics Workspace doesn't have the data export option
My goal is to send the collected VM data to the third-party SIEM platform in Azure 21v
Where is your app failing? I assume maybe the data is too large or not formatted to input into the event hub. I haven't worked with this scenario before, but I assume you would send each row to the event hub. Maybe I am wrong there. I would look for examples of event hub used in other apps and check the connector documentation. The Sentinel GitHub repo might have a working example.
@Neal Lu (CN) Thanks for reaching out. The above workflow looks good as you mentioned you only need to use logic app. As per the screenshot the send event was successfully executed. Can you please verify what's the output for the Send event action for any of the successful run. Please share the configuration for the action Send event and how you have verified that the events were not received at the event hub end? Have you configured any application or used service bus explorer to verify it?