SumoLogic · sachin-sumologic · May 13, 2025 · May 12, 2025 · May 12, 2025 · May 12, 2025
@@ -22,8 +22,7 @@ To learn more about configuring monitoring for Azure functions, refer to the [Az
 
 * **Activity logs**. Provides insight into any subscription-level or management group level events that have occurred in Azure. To learn more, refer to [Azure documentation](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema).
 
-* **Azure Functions specific metrics**. These are metrics specific to Functions like execution count and execution units.
-For more information on supported metrics, refer to [Azure documentation](https://learn.microsoft.com/en-us/azure/azure-functions/monitor-functions-reference#azure-functions-specific-metrics).
+* **Azure Functions specific metrics**. These are metrics specific to Functions like execution count and execution units. For more information on supported metrics, refer to [Azure documentation](https://learn.microsoft.com/en-us/azure/azure-functions/monitor-functions-reference#azure-functions-specific-metrics).
 * **General App Service metrics**. Metrics which App Service platform implements. These metrics are available in the `Microsoft.Web/sites` namespace. For more information on supported metrics, refer to [Azure documentation](https://learn.microsoft.com/en-us/azure/app-service/web-sites-monitor#understand-metrics).
 
 ### Sample queries
@@ -37,102 +36,15 @@ tenant_name=* subscription_id=* location=* resource_group=* provider_name=micros
 Azure service sends monitoring data to Azure Monitor, which can then [stream data to Eventhub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports:
 
 * Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/).
-* Metrics collection using our [HTTP Logs and Metrics source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/) via Azure Functions deployed using the ARM template.
+* Metrics collection using our [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source).
 
 You must explicitly enable diagnostic settings for each Azure Functions you want to monitor. Diagnostic Settings are not supported for function apps running on version 1.x. You can forward logs to the same Event Hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations).
 
 When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/FunctionApp/Logs`, `Azure/FunctionApp/Metrics`.
 
-### Configure field in field schema
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. 
-1. Search for the following fields:
-   - `tenant_name`. This field is tagged at the collector level and you can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
-   - `location`. The region to which the resource name belongs.
-   - `subscription_id`. ID associated with a subscription where the resource is present.
-   - `resource_group`. The resource group name where the Azure resource is present.
-   - `provider_name`. Azure resource provider name (for example, Microsoft.WEB).
-   - `resource_type`. Azure resource type (for example, SITES).
-   - `resource_name`. The name of the resource (for example, Azure Function App name).
-1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields).
-
-### Configure Field Extraction Rules
-
-Create a Field Extraction Rule (FER) by following the instructions [here](/docs/manage/field-extractions/create-field-extraction-rule/). If the FER already exists with the same name, then skip this step.
-
-#### Azure Location Extraction FER
-
-```sql
-Rule Name: AzureLocationExtractionFER
-Applied at: Ingest Time
-Scope (Specific Data): tenant_name=*
-```
-
-```sql title="Parse Expression"
-json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop
-| replace(toLowerCase(resourceLocation), " ", "") as resourceLocation
-| if (!isBlank(resourceLocation), resourceLocation, location) as location
-| if (!isBlank(service_region), service_region, location) as location
-| if (isBlank(location), "global", location) as location
-| fields location
-```
-
-#### Resource ID Extraction FER
-
-```sql
-Rule Name: AzureResourceIdExtractionFER
-Applied at: Ingest Time
-Scope (Specific Data): tenant_name=*
-```
-
-```sql title="Parse Expression"
-json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop
-| if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId
-| toUpperCase(resourceId) as resourceId
-| parse regex field=resourceId "/SUBSCRIPTIONS/(?<subscription_id>[^/]+)" nodrop
-| parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop
-| parse regex field=resourceId "/PROVIDERS/(?<provider_name>[^/]+)" nodrop
-| parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?<resource_type>[^/]+)/(?<resource_name>.+)" nodrop
-| parse regex field=resource_name "(?<parent_resource_name>[^/]+)(?:/PROVIDERS/[^/]+)?/(?<service_type>[^/]+)/?(?<service_name>.+)" nodrop
-| if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name
-| fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name
-```
-
-
-### Configure metric rules
-
-#### Azure Observability Metadata Extraction Service Level
-
-If this rule already exists, there's no need to create it again.
-
-```sql
-Rule Name: AzureObservabilityMetadataExtractionAppServiceLevel
-```
-
-```sql title="Metric match expression"
-resourceId=/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/*/SITES/* tenant_name=*
-```
-
-| Fields extracted | Metric rule    |
-|:-----------------|:---------------|
-| `subscription_id`  | $resourceId._1 |
-| `resource_group`   | $resourceId._2 |
-| `provider_name`    | $resourceId._3 |
-| `resource_type`    | SITES |
-| `resource_name`    | $resourceId._4 |
-
-
 ### Configure metrics collection
 
-In this section, you will configure a pipeline for shipping metrics from Azure Monitor to an Event Hub, onto an Azure Function, and finally to an HTTP Source on a hosted collector in Sumo Logic.
-
-1. Create a hosted collector and tag the `tenant_name` field. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). <br/><img src={useBaseUrl('img/integrations/microsoft-azure/Azure-Storage-Tag-Tenant-Name.png')} alt="Azure Tag Tenant Name" style={{border: '1px solid gray'}} width="500" />
-1. [Configure an HTTP Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-1-configure-an-http-source).
-1. [Configure and deploy the ARM Template](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-2-configure-azure-resources-using-arm-template).
-1. [Export metrics to Event Hub](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-3-export-metrics-for-a-particular-resource-to-event-hub). Perform the steps below for each Azure Functions that you want to monitor.
-   1. Choose `Stream to an event hub` as the destination.
-   1. Select `AllMetrics`.
-   1. Use the Event Hub namespace created by the ARM template in Step 2 above. You can create a new Event Hub or use the one created by the ARM template. You can use the default policy `RootManageSharedAccessKey` as the policy name.
-4. Tag the location field in the source with the right location value.<br/><img src={useBaseUrl('img/integrations/microsoft-azure/Azure-Storage-Tag-Location.png')} alt="Azure Functions app Tag Location" style={{border: '1px solid gray'}} width="400" />
+To set up the Azure Metrics source in Sumo Logic, refer to [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source).
 
 ### Configure logs collection
 
@@ -177,6 +89,18 @@ import AppInstall2 from '../../reuse/apps/app-install-v2.md';
 
 <AppInstall2/>
 
+As part of the app installation process, the following fields will be created by default:
+
+- `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
+- `location`. The region to which the resource name belongs to.
+- `subscription_id`. ID associated with a subscription where the resource is present.
+- `resource_group`. The resource group name where the Azure resource is present.
+- `provider_name`. Azure resource provider name (for example, Microsoft.Network).
+- `resource_type`. Azure resource type (for example, storage accounts).
+- `resource_name`. The name of the resource (for example, storage account name).
+- `service_type`. Type of the service that can be accessed with a Azure resource.
+- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions).
+
 ## Viewing the Azure Functions dashboards
 
 import ViewDashboards from '../../reuse/apps/view-dashboards.md';
@@ -295,7 +219,7 @@ Use this dashboard to:
 
 ### Administrative Operations
 
-The **Azure SQL - Administrative Operations** dashboard provides details on read/write/delete specific changes, different operations used, the top 10 operations that caused the most errors, and users performing admin operations.
+The **Azure Functions - Administrative Operations** dashboard provides details on read/write/delete specific changes, different operations used, the top 10 operations that caused the most errors, and users performing admin operations.
 
 Use this dashboard to:
 * Identify top users performing administrative operations.
@@ -304,6 +228,36 @@ Use this dashboard to:
 
 <img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Azure-Functions/Azure-Functions-Administrative-Operations.png')} alt="Azure Functions Administrative Operations dashboard" style={{border: '1px solid gray'}} width="800" />
 
+### Instances
+
+The **Azure Functions - Instances** dashboard provides information of all effect action details performed based on Azure Functions Instances.
+
+Use this dashboard to:
+* View recent resource usage and performance based on Instances.
+* View distribution and service usage of resources by Instance.
+
+<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Azure-Functions/Azure-Functions-Instance.png')} alt="Azure Functions Instances dashboard" style={{border: '1px solid gray'}} width="800" />
+
+
+## Create monitors for Azure Functions app
+
+import CreateMonitors from '../../reuse/apps/create-monitors.md';
+
+<CreateMonitors/>
+
+### Azure Functions alerts
+
+These alerts are metrics-based and will work for all Functions.
+
+| Alert Name                                | Description                                                                                | Alert Condition | Recover Condition |
+|:------------------------------------------|:-------------------------------------------------------------------------------------------|:----------------|:------------------|
+| `Azure Functions - Average Response Time` | This alert gets triggered when there is high response time detected in any Azure Function. | Count < 1       | Count >= 1        |
+| `Azure Functions - Delete function app`   | This alert gets triggered when a function app is deleted.                                  | Count >= 1      | Count < 1         |
+| `Azure Functions - Health Check Status`   | This alert gets triggered when there is Health Check Status average drops less than 100.   | Count < 100     | Count >= 100      |
+| `Azure Functions - Http 4xx Error`        | This alert gets triggered when HTTP 4xx errors are high in the Azure Functions.            | Count > 25      | Count =< 25       |
+| `Azure Functions - Https Server Error`    | This alert gets triggered when HTTP 5xx errors are high in the Azure Functions.            | Count > 25      | Count =< 25       |
+
+
 ## Upgrade/Downgrade the Azure Functions app (Optional)
 
 import AppUpdate from '../../reuse/apps/app-update.md';

@@ -24,26 +24,12 @@ For Azure Virtual Machine, you can collect the following logs and metrics:
 Azure service sends monitoring data to Azure Monitor, which can then [stream data to Eventhub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports:
 
 * Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/).
+* Metrics collection using our [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source).
 
 You must explicitly enable diagnostic settings for each Virtual Machine you want to monitor. You can forward logs to the same event hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations).
 
 When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/VM/ActivityLogs`, `Azure/VM/Metrics`.
 
-### Configure field in field schema
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**.
-1. Search for the following fields:
-    - `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
-    - `location`. The region to which the resource name belongs to.
-    - `subscription_id`. ID associated with a subscription where the resource is present.
-    - `resource_group`. The resource group name where the Azure resource is present.
-    - `provider_name`. Azure resource provider name (for example, Microsoft.Network).
-    - `resource_type`. Azure resource type (for example, storage accounts).
-    - `resource_name`. The name of the resource (for example, storage account name).
-    - `service_type`. Type of the service that can be accessed with a Azure resource.
-    - `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions).
-1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields).
-
 ### Configure metric rules
 
 * **Azure Observability Metadata Extraction VMName**
@@ -61,16 +47,9 @@ tenant_name=* namespace=Microsoft.Compute/virtualMachines resource_name=*
 | Fields extracted | Metric rule    |
 |:--|:--|
 | `vmname`  | `$resource_name._1` |
-
 ### Configure metrics collection
 
-:::note
-The Sumo Logic metrics source for Azure is currently in Beta. To participate, contact your Sumo Logic account executive.
-:::
-
-1. To set up the Azure Metrics source in Sumo Logic, refer to the shared beta documentation.
-1. In the Sumo Logic Azure Metrics source configuration, configure namespaces as `Microsoft.Compute/virtualMachines` and `Microsoft.Compute/virtualMachineScaleSets`.
-<img src={useBaseUrl('img/integrations/microsoft-azure/azure-virtual-machine-namespaces.png')} alt="Azure Virtual Machine Namespaces" style={{border: '1px solid gray'}} width="500" />
+To set up the Azure Metrics source in Sumo Logic, refer to [Azure Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source).
 
 ### Configure logs collection
 
@@ -99,6 +78,18 @@ import AppInstallNoDataSourceV2 from '../../reuse/apps/app-install-index-apps-v2
 
 <AppInstallNoDataSourceV2/>
 
+As part of the app installation process, the following fields will be created by default:
+
+- `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name).
+- `location`. The region to which the resource name belongs to.
+- `subscription_id`. ID associated with a subscription where the resource is present.
+- `resource_group`. The resource group name where the Azure resource is present.
+- `provider_name`. Azure resource provider name (for example, Microsoft.Network).
+- `resource_type`. Azure resource type (for example, storage accounts).
+- `resource_name`. The name of the resource (for example, storage account name).
+- `service_type`. Type of the service that can be accessed with a Azure resource.
+- `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances the service is Subscriptions).
+
 ## Viewing the Azure Virtual Machine dashboards
 
 import ViewDashboards from '../../reuse/apps/view-dashboards.md';
@@ -186,12 +177,14 @@ These alerts are metric based and will work for all Virtual Machine.
 | `Azure Virtual Machine - Data Disk IOPs Consumed Monitor` | This alert is triggered when Data Disk IOPs consumption percentage spikes above 95% are detected for any VM. | Count > 95 | Count =< 95 |
 | `Azure Virtual Machine - OS Disk IOPs Consumed Monitor`| This alert is triggered when OS Disk IOPs consumption percentage spikes above 95% are detected for any VM. | Count > 95 | Count =< 95 |
 
-## Upgrade/Downgrade the Azure Virtual Network app (optional)
+## Upgrade/Downgrade the Azure Virtual Machine app (optional)
 
 import AppUpdate from '../../reuse/apps/app-update.md';
 
 <AppUpdate/>
 
-## Uninstalling the Azure Virtual Network app (optional)
+## Uninstalling the Azure Virtual Machine app (optional)
 
 import AppUninstall from '../../reuse/apps/app-uninstall.md';
+
+<AppUninstall/>