community.general.loganalytics_ingestion callback – Posts task results to an Azure Log Analytics workspace using the new Logs Ingestion API

Note

This callback plugin is part of the community.general collection (version 12.4.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general. You need further requirements to be able to use this callback plugin, see Requirements for details.

To use it in a playbook, specify: community.general.loganalytics_ingestion.

New in community.general 12.4.0

Callback plugin

This plugin is a notification callback. It sends information for a playbook run to other applications, services, or systems. See Callback plugins for more information on callback plugins.

Synopsis

  • This callback plugin will post task results in JSON format to an Azure Log Analytics workspace using the new Logs Ingestion API.

Requirements

The below requirements are needed on the local controller node that executes this callback.

  • The callback plugin has been enabled.

  • An Azure Log Analytics workspace has been established.

  • A Data Collection Rule (DCR) and custom table are created.

Parameters

Parameter

Comments

client_id

string / required

Client ID of the Azure App registration for OAuth2 authentication (“Modern Authentication”).

Configuration:

client_secret

string / required

Client Secret of the Azure App registration.

Configuration:

dce_url

string / required

URL of the Data Collection Endpoint (DCE) for Azure Logs Ingestion API.

Configuration:

dcr_id

string / required

Data Collection Rule (DCR) ID for the Azure Log Ingestion API.

Configuration:

disable_attempts

integer

When disable_on_failure=true, number of plugin failures that must occur before the plugin is disabled.

This helps prevent outright plugin failure from a single, transient network issue.

Default: 3

Configuration:

disable_on_failure

boolean

Stop trying to send data on plugin failure.

Choices:

  • false

  • true ← (default)

Configuration:

include_content

boolean

Send the content to the Azure Log Analytics workspace.

Choices:

  • false ← (default)

  • true

Configuration:

include_task_args

boolean

Send the task args to the Azure Log Analytics workspace.

Choices:

  • false ← (default)

  • true

Configuration:

stream_name

string / required

The name of the stream used to send the logs to the Azure Log Analytics workspace.

Configuration:

tenant_id

string / required

Tenant ID for the Azure Active Directory.

Configuration:

timeout

integer

Timeout for the HTTP requests to the Azure Log Analytics API.

Default: 2

Configuration:

Notes

Note

  • Triple verbosity logging (-vvv) can be used to generate JSON sample data for creating the table schema in Azure Log Analytics. Search for the string Event Data: in the output in order to locate the data sample.

See Also

See also

Logs Ingestion API

Overview of Logs Ingestion API in Azure Monitor

Examples

examples: |
  Enable the plugin in ansible.cfg:
    [defaults]
    callback_enabled = community.general.loganalytics_ingestion
  Set the environment variables:
    export ANSIBLE_LOGANALYTICS_DCE_URL=https://my-dce.ingest.monitor.azure.com
    export ANSIBLE_LOGANALYTICS_DCR_ID=dcr-xxxxxx
    export ANSIBLE_LOGANALYTICS_CLIENT_ID=xxxxxxxx
    export ANSIBLE_LOGANALYTICS_CLIENT_SECRET=xxxxxxxx
    export ANSIBLE_LOGANALYTICS_TENANT_ID=xxxxxxxx
    export ANSIBLE_LOGANALYTICS_STREAM_NAME=Custom-MyTable

Authors

  • Wade Cline (@wtcline-intc)

  • Sriramoju Vishal Bharath (@vsh47)

  • Cyrus Li (@zhcli)

Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.