Export of Azure Functions Logs to Elasticsearch on Azure

Question

Export of Azure Functions Logs to Elasticsearch on Azure

Savva 40

Hello! I would like to know what is the best way to stream logs of Azure Functions to Elasticsearch deployed using native integration between Azure and Elastic Cloud?

Accepted answer

0 additional answers

Your answer

Answer 1

David Pazdera 396

Hello Savva, This should be a two-step process:

Create Elastic resource (a reference point to your Elastic Cloud setup) by following this guide. Leave checkboxes in the Logs & metrics tab empty**.**
For your Function App, configure Diagnostic settings and for the Destination details, select the Elastic resource you created in step 1. It can be created in a different subscription than the one you use for the Function App. You can follow this guide here.

In case something doesn't work, you can use this handy troubleshooting guide: https://learn.microsoft.com/en-us/azure/partner-solutions/elastic/troubleshoot

Savva 40 Reputation points

2023-04-05T20:55:34.3533333+00:00
Hello, David. Thank you for your answer, this solution has worked out but I have few doubts:

To do any type of filtering and transformation of the logs, our only option is to do it on the Elastic side, yes?

In case we also use Application Insights to collect logs and metrics from our Azure Functions, should we send the logs to Elastic from Azure Function App or is it better to do that from the level of Application Insights. As I understood each Azure Function App can export table FunctionAppLogs and Application Insights can export table called traces, are they completely different or do they have some duplicated information because traces table has a field called message that looks like log information.
David Pazdera 396 Reputation points

2023-04-06T09:44:13.9633333+00:00

Hi Savva, As far as I know, the capability to transform logs is only available when you are sending data to Log Analytics workspace. You can find more info here. In theory, you could then use Export function to stream such telemetry from Log Analytics to an external system, but the streaming is done via Event Hubs and not by using 'Partner integrations' (like Elastic), so this would be rather complex and costly solution. So, you are correct that it is easier in this case to do any transformation on the Elastic side. With regards to the difference between Diagnostic Settings and Application Insights for Function Apps, I believe there is a difference on what gets logged since App Insights focuses on application performances and distributed traces. It wouldn't make sense to collect the same telemetry twice, but I don't think there is an overlap. It is worth double-checking it though.
Savva 40 Reputation points

2023-04-06T22:19:29.87+00:00

Hello, David. Thank you for the detailed explanation. Can you recommend, please, any source of information on how App Insights traces are different from normal Function logging?

Share via

Export of Azure Functions Logs to Elasticsearch on Azure

0 additional answers

Your answer