Jed Laundry

FYI, as of November 2020 the Azure team had this on a backlog somewhere: https://github.com/MicrosoftDocs/azure-docs/pull/46099

Hi @manicminer, I've got a little bit of time coming up where I could work on a potential solution, and I'm keen for your thoughts before I start: Instead of...

Example config (you can use the instructions at https://learn.microsoft.com/en-us/azure/sentinel/connect-logstash-data-connection-rules#example-dcr-that-ingests-data-into-the-syslog-table to create an appropriate DCR): ``` [INPUT] Name dummy Dummy {"Computer": "dummy", "Message":"This is a test."} [OUTPUT] Name stdout Format json_lines...

Debug log: (sensitive values zeroised) [debug.log](https://github.com/fluent/fluent-bit/files/14227054/debug.log)

Valgrind output: ``` ==41351== ==41351== HEAP SUMMARY: ==41351== in use at exit: 1,524 bytes in 4 blocks ==41351== total heap usage: 26,563 allocs, 26,559 frees, 21,018,260 bytes allocated ==41351== ==41351==...

Just checking, was there anything else I need to do?

@kforeverisback just checking, did you manage to take a look?

😮 Surprise! What's this? https://packages.microsoft.com/debian/12/prod/pool/main/a/azure-functions-core-tools/ Looks like 12 (bookworm) support was silently added in 4.0.5571 (and the change broke Debian 11, as 11 doesn't support zst compression: https://github.com/Azure/azure-functions-core-tools/issues/3626)

@mverbaas it looks like you need to add the Microsoft key first: ```bash curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null ``` Or, if you prefer...

I've started taking a look at this (it's my first time using Rust for something non-trivial, so any feedback on what I've done wrong is welcome): https://github.com/vectordotdev/vector/compare/master...jlaundry:vector:feature-azure_logs_ingestion Still a couple...