Azure App Service Integration

Azure App Service provides different logging to help you track, monitor, and debug your web application.

This integration currently collects one data stream: App Service Logs.

The Azure App Service logs integration retrieves different types of logs categories from Azure App Service:

• HTTPLogs help monitor application health, performance and usage patterns.
• AuditLogs provide insights when publishing users successfully log on via one of the App Service publishing protocols.
• IPSecAuditLogs are generated through your application and pushed to Azure Monitoring.
• PlatformLogs are generated through AppService platform for your application.
• ConsoleLogs are generated from application or container.
• AppLogs are generated through your application (for example, logging capabilities).

Refer to the Azure Logs page for more information on requirements and setup instructions.

Authentication (Event Hub): The Event Hub input supports two authentication methods: connection string (default) and client secret (Microsoft Entra ID). For setup steps, required RBAC roles (Azure Event Hubs Data Receiver, Storage Blob Data Contributor), and configuration options, see the Azure Logs integration or Filebeat azure-eventhub input documentation.

By default, the integration uses AMQP ports 5671 and 5672 to communicate with Event Hubs. If these ports are blocked, set Event Hubs transport protocol to AMQP-over-WebSockets in the advanced options. This tunnels AMQP over HTTPS on port 443.

This option requires the Event Hub processor v2 (Processor version set to v2, which is the default) and Elastic Agent 8.19.10, 9.1.10, 9.2.4, or later.

Proxy support is optional and requires Event Hubs transport protocol set to AMQP-over-WebSockets.

To enable it:

1. In the advanced options, set Event Hubs transport protocol to AMQP-over-WebSockets.
2. Define the HTTPS_PROXY environment variable for the Elastic Agent process, for example HTTPS_PROXY=http://proxy.example.com:8080. Elastic Agent routes both Event Hubs and Storage Account traffic through the proxy.

This requires processor v2 and Elastic Agent 8.19.10, 9.1.10, 9.2.4, or later.

Collects different types of logs from Azure App Service via Event Hub.

{
    "agent": {
        "name": "EPGETBIW05AD",
        "id": "e42ad9e7-fc37-4342-80cc-ee5bcb314f5d",
        "ephemeral_id": "65e0aae6-d877-4830-b9f0-10b0ccd39bb9",
        "type": "filebeat",
        "version": "8.18.3"
    },
    "@timestamp": "2025-10-28T09:39:57.805Z",
    "ecs": {
        "version": "8.11.0"
    },
    "data_stream": {
        "namespace": "default",
        "type": "logs",
        "dataset": "azure_app_service.app_service_logs"
    },
    "elastic_agent": {
        "id": "e42ad9e7-fc37-4342-80cc-ee5bcb314f5d",
        "version": "8.18.3",
        "snapshot": false
    },
    "event": {
        "agent_id_status": "verified",
        "ingested": "2025-10-28T09:40:37Z",
        "dataset": "azure_app_service.app_service_logs"
    },
    "tags": [
        "azure-appservice",
        "forwarded"
    ],
    "azure": {
        "resource": {
            "id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/IMERLISHVILI-TEST/PROVIDERS/MICROSOFT.WEB/SITES/LEMON-FLOWER-AF075F43C47545E6B4248C46905E5188"
        },
        "app_service": {
            "result_description": "169.254.129.1 - - [28/Oct/2025:09:39:57 +0000] \"GET /static/favicon.ico HTTP/1.1\" 200 0 \"https://lemon-flower-af075f43c47545e6b4248c46905e5188.azurewebsites.net/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\"",
            "level": "Informational",
            "event_stamp_name": "waws-prod-fra-033",
            "operation_name": "Microsoft.Web/sites/log",
            "event_ip_address": "10.30.0.225",
            "event_primary_stamp_name": "waws-prod-fra-033",
            "event_stamp_type": "Stamp",
            "host": "10-30-0-225",
            "category": "AppServiceConsoleLogs",
            "container_id": "a9ea19c60625_lemon-flower-af075f43c47545e6b4248c46905e5188"
        }
    }
}

ECS Field Reference

Refer to the following document for detailed information on ECS fields.

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.