}){kind=logo}
| [AWS Simple Notification Service](https://aws.amazon.com/sns/) | Automation integration: [AWS Simple Notification Service](/docs/platform-services/automation-service/app-central/integrations/aws-simple-notification-service/) |
| })
| [AWS WAF](https://aws.amazon.com/waf/) | Apps: })
| [Axonius](https://www.axonius.com/) | Automation integration: [Axonius](/docs/platform-services/automation-service/app-central/integrations/axonius/) |
-| }){kind=logo}
| [Azure](https://azure.microsoft.com/en-us) | Apps: })
4. Create a [Shared Access Policy](https://docs.microsoft.com/en-us/azure/governance/policy/overview) with the Listen claim to the newly created Event Hub Instance. In this example, Event Hub Instance is set to `SumoCollectionPolicy`.})
})
})
5. Copy the **Shared access policies** Key. Copy the **Primary key** associated with this policy.})
-6. When [configuring the Azure Event Hubs Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source/#vendor-configuration) in Sumo Logic, our input fields might be:
+6. When [configuring the Azure Event Hubs Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/#vendor-configuration) in Sumo Logic, our input fields might be:
| Field | Value |
|:---|:---|
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md
deleted file mode 100644
index 706cd8c5b4..0000000000
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md
+++ /dev/null
@@ -1,150 +0,0 @@
----
-id: azure-event-hubs-source
-title: Azure Event Hubs Source
-tags:
- - cloud-to-cloud
- - azure-event-hubs
-sidebar_label: Azure Event Hubs
----
-
-import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
-import useBaseUrl from '@docusaurus/useBaseUrl';
-
-:::important
-From April 30, 2025, Sumo Logic will no longer support adding a source using this Azure Event Hubs source. Existing Azure Event Hubs source configurations will still work for some time, but we recommend you [migrate](/docs/send-data/collect-from-other-data-sources/azure-monitoring/azure-event-hubs-source-migration/) to the [Azure Event Hubs Source for Logs](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/).
-:::
-
-:::note
-Collecting data from Azure Event Hubs using this Cloud-to-Cloud collection method supports a throughput limit of 1MB/s (86GB/day) per named Event Hub egress rate. If you require higher throughput, we recommend using [Azure Event Hubs Source for Logs](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source).
-:::
-
-})
-1. Create an Event Hubs namespace. In this example, Namespace is set to **cnctest**:})
})
-1. Create an Event Hub Instance.})
- * Shared Access Policies can be set up for the entire namespace. These policies can be used to access/manage all hubs in the namespace. A policy for the namespace is created by default: **RootManageSharedAccessKey** }){kind=small}
A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
- * }){kind=small}
An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**.
-1. **Azure Event Hubs Namespace**. Enter your Azure Event Hubs Namespace name.
-1. **Event Hubs Instance Name**. Enter the Azure Event Hubs Instance Name.
-1. **Shared Access Policy**. Enter your Shared Access Policy Name and Key. The Shared Access Policy requires the **Listen** claim.
-1. **Consumer Group Name**. If needed, specify a custom consumer group name. When using a custom **Consumer Group** make sure that it exists for the Event Hub instance.
-1. **Receive data with latest offset or from timestamp**. Choose one of the following options:
- * **Latest offset** (default) - this will start the receiver with the latest offset and collect any new logs received to the Event Hub moving forward.
- * **Timestamp** - use this option to start receiving logs from a specific point in time in the event stream. **Timestamp** can be used to ingest historical data. Once all historical data has been ingested it is recommended to switch to **Latest offset.** This will ensure the Collector continues from the latest recorded checkpoint when restarted and not use the **Timestamp** specified as a starting point, which could result in logs being received and processed more than once.
-1. **Processing Rules for Logs**. Configure any desired filters, such as allowlist, denylist, hash, or mask, as described in Create a Processing Rule.
-1. **Advanced Options for Logs**.
- * **Timestamp Parsing**. This option is selected by default. If it's deselected, no timestamp information is parsed at all.
- * **Time Zone**. There are two options for Time Zone. You can use the time zone present in your log files, and then choose an option in case time zone information is missing from a log message. Or, you can have Sumo Logic completely disregard any time zone information present in logs by forcing a time zone. It's very important to have the proper time zone set, no matter which option you choose. If the time zone of logs cannot be determined, Sumo Logic assigns logs UTC; if the rest of your logs are from another time zone your search results will be affected.
- * **Timestamp Format**. By default, Sumo Logic will automatically detect the timestamp format of your logs. However, you can manually specify a timestamp format for a Source. See [Timestamps, Time Zones, Time Ranges, and Date Formats](/docs/send-data/reference-information/time-reference) for more information.
-1. When you are finished configuring the Source, click **Submit**.
-
-## Metadata fields
-
-| Field | Value | Description |
-| :--- | :--- | :--- |
-| `_siemDataType` | `Inventory` | Set when **Forward To SIEM** is checked. |
-| `_siemProduct` | `Azure` | Set when **Forward To SIEM** is checked. |
-| `_siemVendor` | `Microsoft` | Set when **Forward To SIEM** is checked. |
-| `_siemFormat` | `JSON` | Set when **Forward To SIEM** is checked. |
-| `_siemEventID` | `The `defaultDateFormats` object has two elements:
`format` (required)—Specify the date format.
`locator` (optional)—A regular expression that specifies the location of the timestamp in your log lines. | For example, `INFO(.*)`
For an example, see [Timestamp example](/docs/send-data/use-json-configure-sources/#timestamp-example).
For more information about timestamp options, see [Timestamps, Time Zones, Time Ranges, and Date Formats](/docs/send-data/reference-information/time-reference). | - -### JSON example - -```json reference -https://github.com/SumoLogic/sumologic-documentation/blob/main/static/files/c2c/azure-event-hubs/example.json -``` - -### Terraform example - -```sh reference -https://github.com/SumoLogic/sumologic-documentation/blob/main/static/files/c2c/azure-event-hubs/example.tf -``` - -## FAQ - -:::info -Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. -::: diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md index c7f9d048e5..2b22bfd573 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md @@ -134,12 +134,6 @@ In this section, we'll introduce the following concepts:
Learn to collect the IAM User Inventory logs from the AWS SDK and send them to Sumo Logic for analysis.
-
-
- })
-Azure Event Hubs
-Provides a secure endpoint to receive data from Azure Event Hubs.
-})