Azure Logs: use one input per agent policy

[zmoog]

Situation

When users install the Azure Logs integration, they can specify only one event hub and enable multiple data streams.

When users enable a data stream, the Azure Logs integration creates one input:

Problem

Each input created for a data stream (e.g., the input 1 from the previous screenshot) is unaware of other inputs. When multiple inputs access an event hub in an uncoordinated way, they create contention for the event hub partitions.

Each input assumes it is the only one accessing the event hub. When the number of inputs reading data from an event hub is higher than 5, they disconnect each other.

Solution

Solution 1: one input with routing

Each Azure Logs integration install must spawn only one input and route log event to the intended destination using routing (routing rule or reroute processor).

Do you want to try this solution on the current version of Azure Logs?

Please follow the steps at zmoog/public-notes#92 to set up log event ingestion using one input + routing.