Skip to content

[extension/azure_encoding] Add support for Administrative, Alert, Autoscale, Policy, Security, ServiceHealth, and ResourceHealth log categories. #45699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
atoulme merged 17 commits into from
Feb 27, 2026
Merged

[extension/azure_encoding] Add support for Administrative, Alert, Autoscale, Policy, Security, ServiceHealth, and ResourceHealth log categories. #45699

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
f029cc2
Port activity logs from translator/azurelogs
zmoog Jan 23, 2026
3e2a66c
Align Autoscale test document
zmoog Jan 28, 2026
56f1976
Align policy test document
zmoog Jan 28, 2026
beb7c14
Align recommendation test document
zmoog Jan 28, 2026
4e6ea86
Align resourcehealth test document
zmoog Jan 28, 2026
65f9389
Align security test document
zmoog Jan 28, 2026
8477f4a
Align servicehealth test document
zmoog Jan 28, 2026
ef14888
Update identity fields in the README
zmoog Jan 28, 2026
c24b60d
Cleanup
zmoog Jan 28, 2026
65831ff
Add changelog entry
zmoog Jan 28, 2026
f6d9f6d
Fix changelog entry
zmoog Jan 28, 2026
4028542
Remove unused const
zmoog Jan 28, 2026
3c89c01
Only set the attribute if the field is populated
zmoog Jan 30, 2026
9599283
Move azure.identity mappings to categories
zmoog Feb 13, 2026
2f01736
Fix lint issues in azureencodingextension
zmoog Feb 17, 2026
d8cd39a
Refine equal-fold comparison
zmoog Feb 24, 2026
53233d3
Restore original golden file
zmoog Feb 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .chloggen/zmoog_azureencodingextension_port-activitylogs-from-translator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Use this changelog template to create an entry for release notes.

# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
change_type: enhancement

# The name of the component, or a single word describing the area of concern, (e.g. receiver/filelog)
component: extension/azure_encoding

# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
note: Add support for Administrative, Alert, Autoscale, Policy, Security, ServiceHealth, and ResourceHealth log categories.

# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
issues: [45699]

# (Optional) One or more lines of additional information to render under the primary note.
# These lines will be padded with 2 spaces and then inserted directly into the document.
# Use pipe (|) for multiline entries.
subtext:

# If your change doesn't affect end users or the exported elements of any package,
# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
# Optional: The change log or logs in which this entry should be included.
# e.g. '[user]' or '[user, api]'
# Include 'user' if the change is relevant to end users.
# Include 'api' if there is a change to a library API.
# Default: '[user]'
change_logs: [user]
179 changes: 166 additions & 13 deletions extension/encoding/azureencodingextension/internal/unmarshaler/logs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,66 @@ in OpenTelemetry Collector pipeline (for example, using `transformprocessor`) or
| `durationMs` | `azure.operation.duration` | Log Attribute |
| `callerIpAddress` | `network.peer.address` | Log Attribute |
| `correlationId` | `azure.correlation_id` | Log Attribute |
| `identity` | `azure.identity` | Log Attribute |
| `identity` | see [Identity Field](#identity-field) below | Log Attribute |
| `Level` | `log.SeverityNumber` | Log |
| `properties` | see mapping for each Category below | mixed |

### Identity Field

The `identity` field has different structures across Azure log categories, so identity parsing is handled per-category:

- **Activity Logs**: Specific known fields are extracted into flat, semantically meaningful attributes (see below)
- **Storage Logs**: Stored as a nested map under `azure.identity` (different structure with authorization as an array)
- **Unknown/Generic categories**: Stored as a nested map under `azure.identity`

Only known useful fields are extracted to minimize the risk of accidentally including sensitive data.

#### Activity Log Identity

Activity Logs contain caller identity information with JWT claims from Azure AD/Entra ID tokens and authorization details.

##### Authorization Fields

| Azure identity Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------|---------------|---------------------|
| `identity.authorization.scope` | `azure.identity.authorization.scope` | Log Attribute |
| `identity.authorization.action` | `azure.identity.authorization.action` | Log Attribute |
| `identity.authorization.evidence.role` | `azure.identity.authorization.evidence.role` | Log Attribute |
| `identity.authorization.evidence.roleAssignmentScope` | `azure.identity.authorization.evidence.role.assignment.scope` | Log Attribute |
| `identity.authorization.evidence.roleAssignmentId` | `azure.identity.authorization.evidence.role.assignment.id` | Log Attribute |
| `identity.authorization.evidence.roleDefinitionId` | `azure.identity.authorization.evidence.role.definition.id` | Log Attribute |
| `identity.authorization.evidence.principalId` | `azure.identity.authorization.evidence.principal.id` | Log Attribute |
| `identity.authorization.evidence.principalType` | `azure.identity.authorization.evidence.principal.type` | Log Attribute |

##### Claims Fields

Unix timestamps (`exp`, `nbf`, `iat`) are converted to RFC3339 format.

| Azure identity.claims Field | OpenTelemetry | OpenTelemetry Scope |
|----------------------------|---------------|---------------------|
| `iss` | `azure.identity.issuer` | Log Attribute |
| `sub` | `azure.identity.subject` | Log Attribute |
| `aud` | `azure.identity.audience` | Log Attribute |
| `exp` | `azure.identity.not_after` | Log Attribute |
| `nbf` | `azure.identity.not_before` | Log Attribute |
| `iat` | `azure.identity.created` | Log Attribute |
| `http://schemas.microsoft.com/identity/claims/scope` | `azure.identity.scope` | Log Attribute |
| `idtyp` | `azure.identity.type` | Log Attribute |
| `appid` | `azure.identity.application.id` | Log Attribute |
| `http://schemas.microsoft.com/claims/authnmethodsreferences` | `azure.identity.auth.methods.references` | Log Attribute |
| `http://schemas.microsoft.com/identity/claims/identityprovider` | `azure.identity.provider` | Log Attribute |
| `http://schemas.microsoft.com/identity/claims/objectidentifier` | `azure.identity.identifier.object` | Log Attribute |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier` | `user.id` | Log Attribute |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | `user.email` | Log Attribute |

#### Storage Log Identity

Storage Logs have a different identity structure containing authorization decisions as an array, token information, and requester details. The entire identity object is stored as a nested map under `azure.identity`.

#### Unknown/Generic Categories

For log categories where the identity structure is not known, the entire identity object is stored as a nested map under `azure.identity` to preserve all data.

## Application Gateway

### Application Gateway Access Logs (both v1 and v2)
Expand Down Expand Up @@ -510,18 +566,6 @@ in OpenTelemetry Collector pipeline (for example, using `transformprocessor`) or
| `roleInstance` | `service.instance.id` | Resource Attribute |
| - | `faas.invoked_provider`=`azure` | Log Attribute |

## Recommendation Logs

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|-------------------------------|---------------------------------------|---------------------|
| `recommendationSchemaVersion` | `azure.recommendation.schema_version` | Log Attribute |
| `recommendationCategory` | `azure.recommendation.category` | Log Attribute |
| `recommendationImpact` | `azure.recommendation.impact` | Log Attribute |
| `recommendationName` | `azure.recommendation.name` | Log Attribute |
| `recommendationResourceLink` | `azure.recommendation.link` | Log Attribute |
| `recommendationType` | `azure.recommendation.type` | Log Attribute |
| `recommendationRisk` | `azure.recommendation.risk` | Log Attribute |

## Storage Blob Logs (StorageRead, StorageWrite, StorageDelete)

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
Expand All @@ -543,3 +587,112 @@ in OpenTelemetry Collector pipeline (for example, using `transformprocessor`) or
| `tlsVersion` | `tls.protocol.name` + `tls.protocol.version`. If unparsable - `tls.protocol.original` | Log Attribute |
| `objectKey` | `azure.storage.object.key` | Log Attribute |
| `sourceAccessTier` | `azure.storage.source.access_tier` | Log Attribute |

## Activity Logs

Activity Logs are a type of Azure platform log that provides insight into subscription-level events. The following categories are supported:

### Administrative

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|-------------------------------------|---------------------|
| `entity` | `azure.administrative.entity` | Log Attribute |
| `message` | `azure.administrative.message` | Log Attribute |
| `hierarchy` | `azure.administrative.hierarchy` | Log Attribute |

### Alert

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|-------------------------------------|---------------------|
| `webHookUri` | `azure.alert.webhook.uri` | Log Attribute |
| `RuleUri` | `azure.alert.rule.uri` | Log Attribute |
| `RuleName` | `azure.alert.rule.name` | Log Attribute |
| `RuleDescription` | `azure.alert.rule.description` | Log Attribute |
| `Threshold` | `azure.alert.threshold` | Log Attribute |
| `WindowSizeInMinutes` | `azure.alert.window_size_minutes` | Log Attribute |
| `Aggregation` | `azure.alert.aggregation` | Log Attribute |
| `Operator` | `azure.alert.operator` | Log Attribute |
| `MetricName` | `azure.alert.metric.name` | Log Attribute |
| `MetricUnit` | `azure.alert.metric.unit` | Log Attribute |

### Autoscale

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|---------------------------------------------|---------------------|
| `Description` | `azure.autoscale.description` | Log Attribute |
| `ResourceName` | `azure.autoscale.resource.name` | Log Attribute |
| `OldInstancesCount` | `azure.autoscale.instances.previous_count` | Log Attribute |
| `NewInstancesCount` | `azure.autoscale.instances.count` | Log Attribute |
| `LastScaleActionTime` | `azure.autoscale.resource.last_scale` | Log Attribute |

### Security

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|-------------------------------------|---------------------|
| `commandLine` | `process.command_line` | Log Attribute |
| `processName` | `process.executable.path` | Log Attribute |
| `userName` | `process.owner` | Log Attribute |
| `UserSID` | `enduser.id` | Log Attribute |
| `processId` | `process.pid` | Log Attribute |
| `parentProcess id` | `process.parent_pid` | Log Attribute |
| `accountLogonId` | `azure.security.account_logon_id` | Log Attribute |
| `domainName` | `azure.security.domain_name` | Log Attribute |
| `ActionTaken` | `azure.security.action_taken` | Log Attribute |
| `Severity` | `azure.security.severity` | Log Attribute |

### Policy

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|-------------------------------------|---------------------|
| `isComplianceCheck` | `azure.policy.compliance_check` | Log Attribute |
| `resourceLocation` | `azure.location` | Log Attribute |
| `ancestors` | `azure.policy.ancestors` | Log Attribute |
| `hierarchy` | `azure.policy.hierarchy` | Log Attribute |
| `policies` | `azure.policy.policies` (parsed as structured array) | Log Attribute |

### Recommendation

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|-------------------------------|---------------------------------------|---------------------|
| `recommendationSchemaVersion` | `azure.recommendation.schema_version` | Log Attribute |
| `recommendationCategory` | `azure.recommendation.category` | Log Attribute |
| `recommendationImpact` | `azure.recommendation.impact` | Log Attribute |
| `recommendationName` | `azure.recommendation.name` | Log Attribute |
| `recommendationResourceLink` | `azure.recommendation.link` | Log Attribute |
| `recommendationType` | `azure.recommendation.type` | Log Attribute |
| `recommendationRisk` | `azure.recommendation.risk` | Log Attribute |

### Service Health

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|---------------------------------------------|---------------------|
| `title` | `azure.servicehealth.title` | Log Attribute |
| `service` | `azure.servicehealth.service` | Log Attribute |
| `region` | `azure.servicehealth.region` | Log Attribute |
| `communication` | `azure.servicehealth.communication.body` | Log Attribute |
| `communicationId` | `azure.servicehealth.communication.id` | Log Attribute |
| `incidentType` | `azure.servicehealth.incident.type` | Log Attribute |
| `trackingId` | `azure.servicehealth.tracking.id` | Log Attribute |
| `impactStartTime` | `azure.servicehealth.impact.start` | Log Attribute |
| `impactMitigationTime` | `azure.servicehealth.impact.mitigation` | Log Attribute |
| `impactedServices` | `azure.servicehealth.impact.services` (parsed as structured array) | Log Attribute |
| `impactType` | `azure.servicehealth.impact.type` | Log Attribute |
| `impactCategory` | `azure.servicehealth.impact.category` | Log Attribute |
| `defaultLanguageTitle` | `azure.servicehealth.default_language.title` | Log Attribute |
| `defaultLanguageContent` | `azure.servicehealth.default_language.content` | Log Attribute |
| `stage` | `azure.servicehealth.state` | Log Attribute |
| `maintenanceId` | `azure.servicehealth.maintenance.id` | Log Attribute |
| `maintenanceType` | `azure.servicehealth.maintenance.type` | Log Attribute |
| `isHIR` | `azure.servicehealth.is_hir` | Log Attribute |
| `IsSynthetic` | `azure.servicehealth.is_synthetic` | Log Attribute |

### Resource Health

| Azure "properties" Field | OpenTelemetry | OpenTelemetry Scope |
|---------------------------|---------------------------------------------|---------------------|
| `title` | `azure.resourcehealth.title` | Log Attribute |
| `details` | `azure.resourcehealth.details` | Log Attribute |
| `currentHealthStatus` | `azure.resourcehealth.state` | Log Attribute |
| `previousHealthStatus` | `azure.resourcehealth.previous_state` | Log Attribute |
| `type` | `azure.resourcehealth.type` | Log Attribute |
| `cause` | `azure.resourcehealth.cause` | Log Attribute |
Loading
Loading