Will old Logstash plugin stop functioning

Question

Will old Logstash plugin stop functioning

Yazan 5

Greetings,

Currently, we use the microsoft-logstash-output-azure-loganalytics plugin to send logs from Linux systems to Sentinel. This plugin is now marked as "Legacy" and MS created a new plugin that is DCR-based but is still in public preview (actually even the old one is still in public preview).

My question is: will the old plugin stop functioning once the new one exits public preview?

Thank you!

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2024-01-03T17:31:31.9666667+00:00

@Yazan

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Yazan 5 Reputation points

2024-01-18T12:47:03.5266667+00:00

Hello @JamesTran-MSFT Thank you for your answer and follow up. I do have a question actually. Since the old logstash plugin uses the same API the OMS agent uses. And since the OMS agent will be deprecated in August, does that mean that the API will be brought out of service? Because if that is the case then the plugin will stop functioning.

1 answer

Your answer

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2024-01-03T17:31:31.9666667+00:00

@Yazan

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Yazan 5 Reputation points

2024-01-18T12:47:03.5266667+00:00

Hello @JamesTran-MSFT Thank you for your answer and follow up. I do have a question actually. Since the old logstash plugin uses the same API the OMS agent uses. And since the OMS agent will be deprecated in August, does that mean that the API will be brought out of service? Because if that is the case then the plugin will stop functioning.

Answer 1

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@Yazan

Thank you for following up on this!

When looking into your issue, I didn't notice anything that would point to the older legacy Logstash plugin being stopped or deprecated. However, I reached out to the Microsoft Sentinel team so they can take a closer look into your issue and will update as soon as possible.

Links:

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-12-12T18:21:13.6333333+00:00
@Yazan

Thank you for your time and patience on this!

I wanted to follow up and let you know that I'm still waiting for a response from the Microsoft Sentinel team.

In the meantime, I did some more research and noticed the Logstash to stream logs with HTTP Data Collection API (legacy) is still in public preview, as you mentioned. Therefore, please keep in mind that this feature doesn't have a service level agreement (SLA) describing Microsoft’s commitment(s) for uptime and connectivity for Microsoft Online Service. Additionally, the Data Collection API (legacy) isn't recommended for production workloads.

I'll continue reaching out to the Microsoft Sentinel team regarding your issue and will update as soon as possible.

Additional Links:

Supplemental Terms of Use for Microsoft Azure Previews

Microsoft Azure Legal Information

Service Level Agreements (SLA) for Online Services

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Share via

Will old Logstash plugin stop functioning

1 answer

Your answer