Prepare Azure Event Hubs to Send Data to Cribl Stream

​

First, create an Azure Event Hub as described in the Azure documentation.

In this tutorial, we use CriblTest as the Namespace name. You can use any Namespace name you like, as long as it is unique across Azure.

Collect the information you will need when configuring Cribl Stream:

1. In the Deployment page, click Go to Resource.

2. Copy the Host Name and store it.

3. Click Shared Access Policies to open the page where you can select policies for your Event Hubs Namespace, and then click RootManageSharedAccessKey to show details for that policy.

4. Copy and securely store the Connection String-primary key.

5. Click on Event Hubs on the left-hand column and copy the Event Hubs name you want to ingest.

Restricting Public Network Access for Cribl.Cloud Deployments

​

If you are using a Cribl.Cloud deployment, you have the option of restricting public network access to the Event Hubs environment.

To restrict access, you will need to obtain the egress IP in your Cribl.Cloud portal, then use it to configure public network access in the Event Hubs environment.

1. To obtain the egress IP, click Access Details and copy the Egress IP of your Cribl.Cloud Organization.

2. In the Azure Event Hubs environment, select Networking > Public network access > Selected networks.

3. On that same page, paste the Cribl.Cloud egress IP into the Address range field in the Event Hubs environment.

Configure the Azure Event Hubs Source in Cribl Stream

​

1. From a Cribl Stream instance’s or Group’s Manage submenu, select Data > Sources, then select Azure Event Hubs from the Manage Sources page’s tiles or left nav. Click New Source to open the Azure Event Hubs > New Source modal.

2. In the General Settings tab, enter the following values:

   • InputId: An InputId of your choice. For example: Stream.
   • Brokers: End the Host Name you wrote down earlier and append port 9093. For this example: CriblTest.servicebus.windows.net:9093.
   • Event Hub Name: The name of your Azure Event Hub. For this example: AzureEH. The Event Hub Name is equivalent to a Kafka topic. It should not be the same as the Azure Event Hubs namespace value you created above.
   • Group ID: This value can be Cribl, but the Group ID cannot be shared with other technologies. Sharing this value across technologies may cause unexpected behavior, such as failing to collect logs reliably.

3. In the Authentication tab, enter or select the following values:

   • SASL mechanism: Options include PLAIN and OAUTHBEARER.
   • Username: $ConnectionString (the default generated by Azure).
   • Authentication Method: Select Manual to use the Connection String Key generated by Azure Event Hubs.
   • Password: Enter the Connection String-primary key that you copied earlier.

Verify that Data is Flowing from Your Azure Event Hub to Cribl Stream

​

Before you can verify that data is reaching Cribl Stream, you must ensure that it is flowing out of your Azure Event Hub in the first place.

One option is to configure a Datagen and a Route to send data to the Event Hub destination. We’ll assume you have done that, or gotten data flowing from your Azure Event Hub in some other way.

1. In Cribl Stream, open the Sources > Azure Event Hubs > Cribl Stream page. This should show your Source, with a message confirming that it is working properly.

2. Open the Live Data tab. You should see the data that is flowing from your Azure Event Hub to Cribl Stream.