Chapter 7. Forward to Azure Monitor

Procedure

1. Create a secret containing your {entra-id} client secret:

   $ oc create secret generic azure-entra-secret \
     --from-literal=client-secret=<your_client_secret> \
     -n openshift-logging

2. Create a ClusterLogForwarder custom resource (CR) or edit your existing CR. Replace the following values with your Azure configuration:

   • Replace <data_collection_endpoint> and <region> with your data collection endpoint URL. Find this URL in the Azure portal under your DCR details or run az monitor data-collection endpoint show.
   • Replace the dcrImmutableId value with your DCR immutable ID. Find this ID in the Azure portal under the DCR JSON view or run az monitor data-collection rule show.
   • Replace the streamName value with the stream name you defined in your DCR. The stream name must match exactly, including the Custom- prefix and _CL suffix if your DCR uses them.
   • Replace the tenantId value with your {entra-id} tenant ID.
   • Replace the clientId value with your {entra-id} application (client) ID.
   • The secretName value should match the name of the secret you created in step 1.

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: azure-logs-forwarder
     namespace: openshift-logging
   spec:
     serviceAccount:
       name: logcollector
     outputs:
     - name: azure-logs-ingestion
       type: azureLogsIngestion
       url: https://<data_collection_endpoint>.<region>.monitor.azure.com
       azureLogsIngestion:
         dcrImmutableId: "dcr-1234567890abcdef1234567890abcdef"
         streamName: "Custom-MyApplicationLogs_CL"
         authentication:
           type: clientSecret
           clientSecret:
             tenantId: "12345678-1234-1234-1234-123456789012"
             clientId: "87654321-4321-4321-4321-210987654321"
             secret:
               secretName: azure-entra-secret
               key: client-secret
     pipelines:
     - name: application-logs
       inputRefs:
       - application
       outputRefs:
       - azure-logs-ingestion

3. Apply the CR:

   $ oc apply -f <filename>.yaml

Verification

1. Check the ClusterLogForwarder status:

   $ oc get clusterlogforwarder instance -n openshift-logging -o jsonpath='{.status.conditions}' | jq

   Look for conditions indicating successful configuration and log delivery.

2. Verify that logs appear in your Azure Log Analytics workspace:

   1. Log in to the Azure portal.
   2. Navigate to your Log Analytics workspace.

   3. Run a query against your custom log table to verify that logs are being ingested:

      MyApplicationLogs_CL
      | take 10

Procedure

1. Create a secret with your shared key:

   apiVersion: v1
   kind: Secret
   metadata:
     name: my-secret
     namespace: openshift-logging
   type: Opaque
   data:
     shared_key: <your_shared_key>

   shared_key

   Must contain a primary or secondary key for the Log Analytics workspace making the request.

2. Obtain a shared key by running the following command in the Azure CLI:

   Get-AzOperationalInsightsWorkspaceSharedKey -ResourceGroupName "<resource_name>" -Name "<workspace_name>”

3. Create or edit your ClusterLogForwarder CR using the template matching your log selection.

   Forward all logs

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: <log_forwarder_name>
     namespace: openshift-logging
   spec:
     serviceAccount:
       name: <service_account_name>
     outputs:
     - name: azure-monitor
       type: azureMonitor
       azureMonitor:
         customerId: my-customer-id
         logType: my_log_type
         authentication:
           sharedKey:
             secretName: my-secret
             key: shared_key
     pipelines:
       - name: app-pipeline
         inputRefs:
         - application
         outputRefs:
         - azure-monitor

   serviceAccount.name

   The name of your service account.

   customerId

   Unique identifier for the Log Analytics workspace. Required field.

   logType

   Record type of the submitted data. Can only contain letters, numbers, and underscores (_), and cannot exceed 100 characters. For more information, see Azure record type in the Microsoft Azure documentation.