User-generated logs are not showing in FunctionAppLogs

Question

I am trying to export FunctionAppLogs to 3rd party monitoring tool such ELK via Diagnostic settings and eventhub.
As Azure Functions writes all logs to the FunctionAppLogs, User-generated logs should be included and sent to eventhub as well.
I can see it in the console as shown in screenshot(This is a demo). However, I cannot see any User-generated logs while exporting to ELK.

Answer 1

Hi @PAUL

There are multiple components involved and this needs to be troubleshot from individual components.
Have you verified if you are able to see the event message "This is a demo" at the event hub? We want to make sure if the issue is between the function app to the event hub or the event hub to ELK.

You can use service bus explorer to view the events from the event hub. If you need any help in verifying this please let me know so we can connect offline.

Please send an email with the subject line “Attn: Mayank” to AzCommunity[at]Microsoft[dot]com referencing this thread along with subscription ID, function app, and event hub details.

Answer 2

Hi @PAUL ,
Did you manage to solve this? I'm getting the same issue.

Answer 3

I'm experiencing exactly the same problem - my logs (created with logging.info(...) in python azure app) are showing in app insights logs (traces table) and console, but not in event hub.
To be clear - I checked events that arrive to event hub with real time explorer, and only azure instrumentation logs show up there.

It's critical for us to be able to export logs to third party logging tools, so would greatly appreciate pointers on how to solve this issue.

Answer 4

I raised a ticket with MS, and they have confirmed that this is how it works for Linux App service plans (all Windows app plans and consumption plan works fine). There is plans to have the functionality added to Linux, but it is not there yet (see https://github.com/Azure/azure-functions-host/issues/6215) . In the meantime, your options are to use a Linux consumption plan, use another language on a Windows plan, or what I have done is created my own logging handler. Ideally, for our workload we would've used a consumption plan, but Linux consumption plans do not support EasyAuth, which is a blocker for us. Therefore, we've created our own logging handler, and added to the logging chain, which then logs all lines to blob storage. It was relatively straight forward. We're using Splunk here, so Splunk can pick up the entries from blob storage easy enough. I'm sure it would be relatively straightforward to also push to an event hub instead/as well.