Preparing the Azure Workspace

Currently, Cribl Stream supports sending data only to custom tables and certain native tables. For details, see Azure’s Supported Tables topic.

To send data to custom tables from Cribl Stream, you must update a DCR Template with Stream definitions. We’ve provided an example DCR Template file.

Prepare the Azure Workspace

​

First, you must prepare the Azure Workspace to receive data from Cribl Stream, by registering Cribl Stream as an authorized application with the Microsoft Identity Platform.

Use Copy buttons, where available, to copy complete values for later use without truncation.

Create Credentials for a New Azure Application

​

1. Log into the Azure portal as an Administrator.
2. Navigate to the portal’s App registration section.
3. Click New registration to register an application.
4. Register a new application with the name Cribl Stream.

5. Click Register.
6. Store the Application (client) ID and Directory (tenant) ID for later steps.
7. In your newly registered application, select the Certificates & secrets tab.
8. Create a New client secret.
9. Store the secret Value for later steps.

Create a Data Collection Endpoint

​

1. Navigate to the Azure portal’s Monitor service.
2. Under Settings, select Data Collection Endpoints.
3. Select Create to add a new endpoint named Cribl-Stream-Ingestion.
4. Select the appropriate Subscription and Resource Group used by your organization.
5. Select Review + create, review your changes, then select Create.
6. In the list of Data Collection Endpoints, open the newly created endpoint. (You might need to refresh the page to see it.)

7. Navigate to the Overview page, and copy and store the Logs Ingestion URL.
8. Select JSON view, and store the value of the Resource ID (gray box at the top) for later use.

Find the Log Analytics Workspace Resource ID

​

1. Navigate to the Azure portal’s Log Analytics workspaces service.
2. Select the workspace that will receive data.
3. From the Overview page, select JSON view, and store the value of the Resource ID (gray box at the top) for later use.

Create Data Collection Rule

​

1. Navigate to the Azure portal’s Deploy a custom template service.
2. Select Build your own template in the editor.
3. Select Load file and upload the DCR Template.
4. Click Save.
5. Select the appropriate Subscription and Resource Group used by your organization.
6. Name the new Data Collection Rule Cribl-Stream-Ingestion-Rule.
7. Enter the Log Analytics Workspace Resource ID, and the Data Collection Endpoint Resource ID, that you stored in the previous steps.
8. To create the Data Collection Rule, click Review + create, followed by Create.

Add Role Assignment

​

1. Once the template has been deployed, click Go to resource.
2. From the Overview page, select the JSON view, and store the immutableId from the JSON body (without quotes) for later use.
3. Click the Data Collection Rule’s Access control (IAM).
4. Click Add role assignment.
5. Select the Monitoring Metrics Publisher role, then click Next.
6. Click + Select members.
7. Search for and select Cribl Stream (the app you created earlier), then click Select to confirm the selection.
8. Click Review + assign to review changes.
9. Click Review + assign again to implement the permissions update.