Microsoft Azure

Azure Monitor: the activity log, resource diagnostic logs, App Service and Functions logs, and Microsoft Entra ID sign-in and audit logs, streamed through an Event Hub.

• Category: Cloud
• How data is sent: Logthread Agent
• Runs on: Linux
• Status: Beta

How it works#

1. Answer a few questions. They only fill in the setup steps. Nothing on this page connects to your servers: Logthread never reaches into your network.
2. Run one command on a machine that reaches the Event Hub. The next page shows the command with this connector's ingest key filled in. It downloads the Logthread Agent from downloads.logthread.com and installs it as a service (Linux, as root with sudo). No other download.
3. Data arrives. Everything is collected inside your environment. It is sent over outbound HTTPS (port 443) to ingest.logthread.com. Nothing is opened to the internet: no inbound ports, VPN or public access to your servers. The connection page shows what has arrived and turns Active with the first record.

What you answer#

Setup#

These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.

Step 1. Create an Event Hub. With the Azure CLI signed in. One namespace and hub collect every log you stream; the Basic tier keeps a day. The last command prints the Listen-only connection string the install step asks for.

RG=my-resource-group; LOCATION=centralindia  # choose yours
az eventhubs namespace create --name logthread-logs --resource-group $RG --location $LOCATION --sku Basic
az eventhubs eventhub create --name logs --namespace-name logthread-logs --resource-group $RG --partition-count 2 --cleanup-policy Delete --retention-time-in-hours 24
# A Listen-only key for the agent (the connection string the install asks for):
az eventhubs eventhub authorization-rule create --name logthread-agent --eventhub-name logs --namespace-name logthread-logs --resource-group $RG --rights Listen
az eventhubs eventhub authorization-rule keys list --name logthread-agent --eventhub-name logs --namespace-name logthread-logs --resource-group $RG --query primaryConnectionString -o tsv

Step 2. Stream logs to the hub. Diagnostic settings send logs as they are written: the activity log, any resource's diagnostic logs, and under Microsoft Entra ID (portal: Monitoring, Diagnostic settings) the sign-in and audit logs.

HUB=$(az eventhubs eventhub show --name logs --namespace-name logthread-logs --resource-group $RG --query id -o tsv)
RULE=$(az eventhubs namespace authorization-rule show --name RootManageSharedAccessKey --namespace-name logthread-logs --resource-group $RG --query id -o tsv)
# The subscription activity log:
az monitor diagnostic-settings subscription create --name logthread --event-hub $HUB --event-hub-auth-rule $RULE --logs '[{"category":"Administrative","enabled":true},{"category":"Security","enabled":true},{"category":"Alert","enabled":true},{"category":"Policy","enabled":true}]'
# Any resource (an App Service, a Function App, a database, Key Vault...), all of its logs:
az monitor diagnostic-settings create --name logthread --resource <resource id> --event-hub $HUB --event-hub-rule $RULE --logs '[{"categoryGroup":"allLogs","enabled":true}]'

Step 3. Install the Logthread Agent. On any Linux machine that reaches the namespace (port 5671). The agent reads the hub, checkpoints its position, and sends over outbound HTTPS. It asks for the connection string (hidden, not kept in your shell history) and writes it to a file only root can read.

curl -sSL https://downloads.logthread.com/agent/install.sh | sudo sh -s -- \
  --key YOUR_INGEST_KEY --profiles azure-eventhub --fleet
printf 'Event Hub connection string: '; stty -echo; read -r LT_PASSWORD; stty echo; echo
sudo tee -a /etc/logthread-agent/agent.env >/dev/null <<EOF
LOGTHREAD_AZURE_EVENTHUB_CONNECTION=$LT_PASSWORD
EOF
unset LT_PASSWORD
sudo systemctl restart logthread-agent

Check that it works#

The connection page under Integrations counts what has arrived and turns Active with the first record. In Explore, search service:azure.

Then add#

Each is one click on the connection page and opens with your data, so you can check it before saving.

• Dashboard: Microsoft Azure: Logs by category and level, operations and their results, failing sign-ins and the busiest resources from Azure Monitor through an Event Hub.
• Alert: Azure errors: service:azure severity:(error|fatal), at least 10 in 10 minutes
• Alert: Entra ID sign-in failures: service:azure azure.category:SignInLogs -azure.result.type:0, at least 20 in 10 minutes

Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.