azure-monitor-ingestion 1.0.4

Description:

azuremonitoringestion 1.0.4

Azure Monitor Ingestion client library for Python
The Azure Monitor Ingestion client library is used to send custom logs to Azure Monitor using the Logs Ingestion API.
This library allows you to send data from virtually any source to supported built-in tables or to custom tables that you create in Log Analytics workspace. You can even extend the schema of built-in tables with custom columns.
Resources:

Source code
Package (PyPI)
Package (Conda)
API reference documentation
Service documentation
Samples
Change log

Getting started
Prerequisites

Python 3.7 or later
An Azure subscription
An Azure Log Analytics workspace
A Data Collection Endpoint
A Data Collection Rule

Install the package
Install the Azure Monitor Ingestion client library for Python with pip:
pip install azure-monitor-ingestion

Create the client
An authenticated client is required to upload Logs to Azure Monitor. The library includes both synchronous and asynchronous forms of the clients. To authenticate, create an instance of a token credential. Use that instance when creating a LogsIngestionClient. The following examples use DefaultAzureCredential from the azure-identity package.
Synchronous clients
Consider the following example, which creates synchronous clients for uploading logs:
import os
from azure.identity import DefaultAzureCredential
from azure.monitor.ingestion import LogsIngestionClient

endpoint = os.environ['DATA_COLLECTION_ENDPOINT']
credential = DefaultAzureCredential()
logs_client = LogsIngestionClient(endpoint, credential)

Asynchronous clients
The asynchronous forms of the client APIs are found in the .aio-suffixed namespace. For example:
import os
from azure.identity.aio import DefaultAzureCredential
from azure.monitor.ingestion.aio import LogsIngestionClient

endpoint = os.environ['DATA_COLLECTION_ENDPOINT']
credential = DefaultAzureCredential()
logs_client = LogsIngestionClient(endpoint, credential)

Configure clients for non-public Azure clouds
By default, LogsIngestionClient is configured to connect to the public Azure cloud. To connect to non-public Azure clouds, some additional configuration is required. The appropriate scope for authentication must be provided using the credential_scopes keyword argument. The following example shows how to configure the client to connect to Azure US Government:
from azure.identity import AzureAuthorityHosts, DefaultAzureCredential
from azure.monitor.ingestion import LogsIngestionClient

# Authority can also be set via the AZURE_AUTHORITY_HOST environment variable.
credential = DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_GOVERNMENT)
logs_client = LogsIngestionClient(endpoint, credential, credential_scopes=["https://monitor.azure.us/.default"])

Key concepts
Data Collection Endpoint
Data Collection Endpoints (DCEs) allow you to uniquely configure ingestion settings for Azure Monitor. This article provides an overview of data collection endpoints including their contents and structure and how you can create and work with them.
Data Collection Rule
Data collection rules (DCR) define data collected by Azure Monitor and specify how and where that data should be sent or stored. The REST API call must specify a DCR to use. A single DCE can support multiple DCRs, so you can specify a different DCR for different sources and target tables.
The DCR must understand the structure of the input data and the structure of the target table. If the two don't match, it can use a transformation to convert the source data to match the target table. You may also use the transform to filter source data and perform any other calculations or conversions.
For more information, see Data collection rules in Azure Monitor, and see this article for details about a DCR's structure. For information on how to retrieve a DCR ID, see this tutorial.
Log Analytics workspace tables
Custom logs can send data to any custom table that you create and to certain built-in tables in your Log Analytics workspace. The target table must exist before you can send data to it. The following built-in tables are currently supported:

CommonSecurityLog
SecurityEvents
Syslog
WindowsEvents

Logs retrieval
The logs that were uploaded using this library can be queried using the Azure Monitor Query client library.
Examples

Upload custom logs
Upload data from JSON file or string
Upload with custom error handling

Upload custom logs
This example shows uploading logs to Azure Monitor.
import os

from azure.core.exceptions import HttpResponseError
from azure.identity import DefaultAzureCredential
from azure.monitor.ingestion import LogsIngestionClient

endpoint = os.environ['DATA_COLLECTION_ENDPOINT']
rule_id = os.environ['LOGS_DCR_RULE_ID']
stream_name = os.environ['LOGS_DCR_STREAM_NAME']

credential = DefaultAzureCredential()
client = LogsIngestionClient(endpoint=endpoint, credential=credential, logging_enable=True)

body = [
{
"Time": "2021-12-08T23:51:14.1104269Z",
"Computer": "Computer1",
"AdditionalContext": "context-2"
},
{
"Time": "2021-12-08T23:51:14.1104269Z",
"Computer": "Computer2",
"AdditionalContext": "context"
}
]

try:
client.upload(rule_id=rule_id, stream_name=stream_name, logs=body)
except HttpResponseError as e:
print(f"Upload failed: {e}")

Upload data from JSON file or string
This example shows uploading when the data is in a JSON file or string.
import json
import os

from azure.core.exceptions import HttpResponseError
from azure.identity import DefaultAzureCredential
from azure.monitor.ingestion import LogsIngestionClient

endpoint = os.environ["DATA_COLLECTION_ENDPOINT"]
rule_id = os.environ['LOGS_DCR_RULE_ID']
stream_name = os.environ["LOGS_DCR_STREAM_NAME"]

credential = DefaultAzureCredential()
client = LogsIngestionClient(endpoint=endpoint, credential=credential, logging_enable=True)

# If you have a JSON file containing an array of JSON objects
file_path = "./test-logs.json"
with open(file_path, "r") as f:
logs = json.load(f)
try:
client.upload(rule_id=rule_id, stream_name=stream_name, logs=logs)
except HttpResponseError as e:
print(f"Upload failed: {e}")

# If you have a JSON string representing an array of JSON objects
string = '[{"Time": "2023-12-08T23:51:14.1104269Z", "Computer": "Computer1", "AdditionalContext": "context-2"}]'
logs = json.loads(string)
try:
client.upload(rule_id=rule_id, stream_name=stream_name, logs=logs)
except HttpResponseError as e:
print(f"Upload failed: {e}")

Upload with custom error handling
To upload logs with custom error handling, you can pass a callback function to the on_error parameter of the upload method. The callback function is called for each error that occurs during the upload and should expect one argument that corresponds to an LogsUploadError object. This object contains the error encountered and the list of logs that failed to upload.
# Example 1: Collect all logs that failed to upload.
failed_logs = []
def on_error(error):
print("Log chunk failed to upload with error: ", error.error)
failed_logs.extend(error.failed_logs)

# Example 2: Ignore all errors.
def on_error_pass(error):
pass

client.upload(rule_id=rule_id, stream_name=stream_name, logs=body, on_error=on_error)

Troubleshooting
For details on diagnosing various failure scenarios, see our troubleshooting guide.
Next steps
To learn more about Azure Monitor, see the Azure Monitor service documentation.
Samples
The following code samples show common scenarios with the Azure Monitor Ingestion client library.
Logs Ingestion samples

Upload a list of logs (async sample)
Upload a list of logs with custom error handling (async sample)
Upload the contents of a file (async sample)
Upload data in a pandas DataFrame (async sample)

Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repositories using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Release History
1.0.4 (2024-06-11)
Other Changes

Bumped minimum dependency on azure-core to >=1.28.0.
Added additional type validation for the logs parameter in the upload method to ensure that a string hasn't been passed in. (#33976)

1.0.3 (2023-11-07)
Other Changes

Add type validation for the logs parameter in the upload method. (#32591)

1.0.2 (2023-06-15)
Bugs Fixed

Fixed issue preventing custom authentication policies or credential scopes to be passed to the client. (#30739)

1.0.1 (2023-04-11)
Bugs Fixed

Fixed an issue where log entry sizes were miscalculated when chunking. (#29584)

1.0.0 (2023-02-16)
Features Added

Added new on_error parameter to the upload method to allow users to handle errors in their own way.

An LogsUploadError class was added to encapsulate information about the error. An instance of this class is passed to the on_error callback.


Added IO support for upload. Now IO streams can be passed in using the logs parameter. (#28373)

Breaking Changes

Removed support for max_concurrency

Other Changes

Removed msrest dependency.
Added requirement for isodate>=0.6.0 (isodate was required by msrest).
Added requirement for typing-extensions>=4.0.1.

1.0.0b1 (2022-07-15)
Features

Version (1.0.0b1) is the first preview of our efforts to create a user-friendly and Pythonic client library for Azure Monitor Ingestion.
For more information about this, and preview releases of other Azure SDK libraries, please visit https://azure.github.io/azure-sdk/releases/latest/python.html.
Added ~azure.monitor.ingestion.LogsIngestionClient to send logs to Azure Monitor along with ~azure.monitor.ingestion.aio.LogsIngestionClient.