[azure] Add support for new Audit Log format by devamanv · Pull Request #15841 · elastic/integrations

devamanv · 2025-11-02T21:07:09Z

Proposed commit message

The PR adds support for new Audit Log format as seen here.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Closes https://github.com/elastic/obs-integration-team/issues/612

…at-support

elastic-vault-github-plugin-prod · 2025-11-02T21:32:20Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-11-02T21:32:23Z

💚 Build Succeeded

Buildkite Build
Commit: 2a2b61a

cc @devamanv

muthu-mps · 2025-11-17T07:35:12Z

packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml

      ignore_missing: true
+  - rename:
+      field: azure.auditlogs.properties.AdditionalDetails
+      target_field: azure.auditlogs.properties.additional_details_as_string


Should this field renamed to additional_details?

muthu-mps · 2025-11-17T07:37:33Z

packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml

      ignore_missing: true
+  - rename:
+      field: azure.auditlogs.properties.Category
+      target_field: azure.auditlogs.properties.category_code


Can we adopt the same field naming pattern from Azure and convert it to snake_case?
azure.auditlogs.properties.category

muthu-mps · 2025-11-17T07:40:06Z

packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml

+      ignore_missing: true
+  - rename:
+      field: azure.auditlogs.properties.ActivityDate
+      target_field: azure.auditlogs.properties.activity_datetime


Should this be activity_date? The below field is already processing activity_datetime.

muthu-mps · 2025-11-17T07:43:46Z

packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml

+      field: azure.auditlogs.properties.Actor.ApplicationName
+      target_field: azure.auditlogs.properties.actor.application_name
+      ignore_missing: true
+      if: ctx.azure?.auditlogs?.properties?.Actor?.ApplicationName != null


Is there a reason to add null check for some rename processor and not for the other processors?

muthu-mps · 2025-11-17T07:46:54Z

packages/azure/data_stream/auditlogs/fields/fields.yml

+                  type: keyword
+                  description: Name of the modified property.
+                - name: new
+                  type: text


Do you think that the value for this field will exceed the keyword limit?
same applies to old as well.

muthu-mps · 2025-11-17T07:54:31Z

...ages/azure/data_stream/auditlogs/_dev/test/pipeline/test-audit-logs-sample.log-expected.json

+                            "33EE33AB6B081AAE8D3393611F5BEF6FF19B60489"
+                        ],
+                        "targets": {
+                            "0": {


The targets should emit list of modified_properties. Can you check why there is an additional value 0? Similarly for modified_properties as well.

botelastic · 2025-12-17T08:48:41Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

botelastic · 2026-01-16T08:48:46Z

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!

botelastic · 2026-02-15T16:42:14Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

Add support for new Audit Log format

e537b0a

devamanv self-assigned this Nov 2, 2025

devamanv added enhancement New feature or request Integration:azure Azure Logs labels Nov 2, 2025

devamanv requested review from a team as code owners November 2, 2025 21:07

devamanv added the Team:Obs-InfraObs Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] label Nov 2, 2025

devamanv requested a review from a team as a code owner November 2, 2025 21:07

devamanv added 2 commits November 3, 2025 02:39

Update PR link in Changelog

0b7f29b

Merge remote-tracking branch 'upstream/main' into audit-logs-new-form…

2a2b61a

…at-support

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Nov 3, 2025

muthu-mps requested a review from lucian-ioan November 4, 2025 14:43

muthu-mps reviewed Nov 17, 2025

View reviewed changes

botelastic bot added the Stalled label Dec 17, 2025

botelastic bot closed this Jan 16, 2026

devamanv reopened this Jan 16, 2026

botelastic bot removed the Stalled label Jan 16, 2026

botelastic bot added the Stalled label Feb 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[azure] Add support for new Audit Log format#15841

[azure] Add support for new Audit Log format#15841
devamanv wants to merge 3 commits intoelastic:mainfrom
devamanv:audit-logs-new-format-support

devamanv commented Nov 2, 2025 •

edited

Loading

Uh oh!

elastic-vault-github-plugin-prod bot commented Nov 2, 2025

Uh oh!

elasticmachine commented Nov 2, 2025

Uh oh!

muthu-mps Nov 17, 2025

Uh oh!

muthu-mps Nov 17, 2025

Uh oh!

muthu-mps Nov 17, 2025

Uh oh!

muthu-mps Nov 17, 2025

Uh oh!

muthu-mps Nov 17, 2025

Uh oh!

muthu-mps Nov 17, 2025

Uh oh!

botelastic bot commented Dec 17, 2025

Uh oh!

botelastic bot commented Jan 16, 2026

Uh oh!

botelastic bot commented Feb 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

devamanv commented Nov 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Uh oh!

elastic-vault-github-plugin-prod bot commented Nov 2, 2025

🚀 Benchmarks report

Uh oh!

elasticmachine commented Nov 2, 2025

💚 Build Succeeded

Uh oh!

muthu-mps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

muthu-mps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

muthu-mps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

muthu-mps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

muthu-mps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

muthu-mps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

botelastic bot commented Dec 17, 2025

Uh oh!

botelastic bot commented Jan 16, 2026

Uh oh!

botelastic bot commented Feb 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

devamanv commented Nov 2, 2025 •

edited

Loading