Output the results of a Log Analytics Workspace query to Event Hub

Question

I'm performing a query to output logs captured in an Azure Log Analytics Workspace, for example: Invoke-AzOperationalInsightsQuery -WorkspaceId '' -Query "AzureDiagnostics | where Category == 'AzureFirewallApplicationRule'"

However I need to send the results of this to an Event Hub for further processing.

I'm trying to use the REST API (https://docs.microsoft.com/en-us/rest/api/eventhub/send-batch-events) but struggling to dynamically generate a request body to send to the Event Hub based on the output fields of the query. This may not be the best way to do it, any suggestions?

Ivan Yang Ivan Yang · Accepted Answer · 2019-11-06T04:32:21

I suggest you can use Send event api by sending a simple json data one by one. Because if you use send batch api, you should build a more complex source data.

You can use the following powershell code to send data to event hub using send event api.

$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId "xxx" -Query "your query"    

#generate sas token
$URI_1 = "event_hub_namespace.servicebus.windows.net/eventhub_path"
$Access_Policy_Name="RootManageSharedAccessKey"
$Access_Policy_Key="the key"

#Token expires now+3000
$Expires=([DateTimeOffset]::Now.ToUnixTimeSeconds())+3000
$SignatureString=[System.Web.HttpUtility]::UrlEncode($URI_1)+ "`n" + [string]$Expires
$HMAC = New-Object System.Security.Cryptography.HMACSHA256
$HMAC.key = [Text.Encoding]::ASCII.GetBytes($Access_Policy_Key)
$Signature = $HMAC.ComputeHash([Text.Encoding]::ASCII.GetBytes($SignatureString))
$Signature = [Convert]::ToBase64String($Signature)
$SASToken = "SharedAccessSignature sr=" + [System.Web.HttpUtility]::UrlEncode($URI_1) + "&sig=" + [System.Web.HttpUtility]::UrlEncode($Signature) + "&se=" + $Expires + "&skn=" + $Access_Policy_Name
$SASToken

$method = "POST"
$url = "https://event_hub_namespace.servicebus.windows.net/eventhub_path/messages"
$signature = $SASToken

# API headers
$headers = @{
            "Authorization"=$signature;
            "Content-Type"="application/atom+xml;type=entry;charset=utf-8";
            }

#use foreach to send data
foreach($s in $queryResults.Results){
    #Write-Output "hello"
    $json = $s | ConvertTo-Json
    #Write-Output $json

    Invoke-WebRequest -Method $method -Headers $headers -Body $json -uri $url
}

Write-Output "**completed**"

After execute the powershell, I use code to receive the data from event hub, and I can confirm that all the data are sent to event hub. The screenshot as below:

Output the results of a Log Analytics Workspace query to Event Hub

1 Answers