Skip to main content
Sumo Logic

Collect Azure Monitor Metrics from Event Hub

To collect Azure metrics from Event Hub, you configure an HTTP source on a hosted collector, use an Azure Resource Manager (ARM) template to create necessary Azure resources, define required environment variables, create an blob container for failover data, and export metrics to Event Hub.

This page has instructions for collecting Azure metrics from the Azure Event Hubs ingestion service, using an Azure Resource Manager (ARM) template. 

Step 1. Configure an HTTP source 

In this step, you configure an HTTP source to which the Azure function will send Azure Monitor metrics.

  1. Select a hosted collector where you want to configure the HTTP source. If desired, create a new hosted collector, as described on Configure a Hosted Collector.
  2. Configure an HTTP source, as described on HTTP Logs and Metrics Source

Step 2. Upload ARM template

  1. Login to
  2. In the left pane, click the plus icon.
  3. In the New pane, enter "template deployment" in the search field, run the search, and select Template Deployment from the search results.
  4. In the Template Deployment pane click Create.
    Add event hub
  5. In the Custom Deployment pane, click Build your own template in the editor.
  6. Download azuredeploy_metrics.json.
  7. In the Edit Template window click Load file, upload the azuredeploy_metrics.json template and then click Save.
  8. In the Custom Deployment pane choose the appropriate Subscription, Resource group, and Location. Check the terms and condition and click Purchase.

    This will create following resources:

    • SumoMetricsNamespace<UniqueSuffix>—The Event Hub namespace that contains insights-metrics-pt1m (eventhub) used for storing metrics.

    • SumoMetricsFunction<UniqueSuffix>——The App Service that hosts the EventHubs_Metrics Azure function. It runs in an App Service plan named SumoMetricsAppServicePlan<UniqueSuffix> (by default the standard App Service plan is configured). The Azure function is triggered by Azure Event Hubs.

    • sumoametlogs<UniqueSuffix>——The storage account used to store the output of the EventHubs_Metrics Azure function.

    • sumometfail<UniqueSuffix>—The storage account used to store failover data from Event Hub.

      Where <UniqueSuffix> is a hash that ensures unique resource names.


Step 3. Configure environment variables

The following environment variables are supported in the EventHubs Lambda function. You can either update the variables in the template or using the Azure console.

Environment Variable  Description
SumoLabsMetricEndpoint A variable for the Sumo HTTP endpoint URL.
 You must update the variable value to the URL for the HTTP source you defined in Step 1. Configure an HTTP source. To find the source's URL, go to Manage > Collection > Collection, navigate the the hosted collector with the HTTP source, and click Show URL next to the source.
AzureEventHubConnectionString A variable containing a connection string for the source Event Hub.
 The ARM template populates this variable.

To determine the connection string for an existing Event Hub:

Click Event Hubs in the left pane, and then select the Event Hub Namespace containing the source Event Hub.

Under Settings, choose Shared access policies. and select an existing access policy with Manage, Send, and Listen permissions.

Click the policy name, and make a note of the connection string. 
StorageConnectionString A variable containing a connection string for sumoaudfail<UniqueSuffix> storage account
. The ARM template populates this variable.

To determine the connection string for an existing storage account:

Select Storage accounts in the left pane. Then, select the storage account that contains the Blob Container.

Under Settings, select Access keys, and make a note of the connection string.

To configure environment variables using the Azure console

  1. Click Function Apps in the left panel of the Azure console
  2. Search for and select the SumoMetricsFunction<UniqueSuffix> App that you created above.
  3. Go to Application Settings
  4. To update an environment variable, under the Application Settings heading, click the existing value of the variable, and update it.
  5. Save your changes. 

Step 4. Create a Blob Container

Create a blob container to store failover data from Event Hub. This procedure assumes that you name the container "sumomet-failover".

To create a blob container:

  1. Select Storage accounts in the left pane.
  2. On the Storage accounts page, select "sumometfail<UniqueSuffix>".
  3. Under Blob Service, select Containers.
  4. To add a new container, select + Container, enter the Name, and select Private for the Public Access Level. Click OK.
  5. Test the function by going to index.js, and clicking Run. To test the receiving endpoint, go to Sumo and use Sumo LiveTail to see the data immediately.

Step 5. Export metrics for a particular resource to Event Hub

Follow theses steps to export metrics for a resource to Event Hub.

  1. From the left pane, select ALL Services.

  2. Search for and select "Monitor".

  3. In the Monitor pane, select Diagnostic Settings under Settings.

  4. Select the resource for which you want to export metrics. If diagnostics is not enabled click Turn on Diagnostics Settings.

  5. Once diagnostics are enabled, click Add a diagnostic setting.

  6. The Diagnostic Settings page appears.

    1. In the left pane
      • Enter a name for the diagnostic setting.
      • Click the  Stream to an event hub checkbox.
      • Select Configure event hub. The right pane appears.
    2. In the right pane:
      • Choose a Subscription.
      • Select SumoMetricsNamespace<UniqueSuffix> as the event hub namespace.
      • Select insights-metrics-pt1m as the event hub name.
      • Select an event hub policy name. You can use the default policy RootManageSharedAccessKey.
    3. Click OK.
    4. Save the Diagnostics Setting.