- Elastic integrations
- Integrations quick reference
- 1Password
- Abnormal Security
- ActiveMQ
- Active Directory Entity Analytics
- Admin By Request EPM integration
- Airflow
- Akamai
- Apache
- API (custom)
- Arbor Peakflow SP Logs
- Arista NG Firewall
- Atlassian
- Auditd
- Auth0
- authentik
- AWS
- Amazon CloudFront
- Amazon DynamoDB
- Amazon EBS
- Amazon EC2
- Amazon ECS
- Amazon EMR
- AWS API Gateway
- Amazon GuardDuty
- AWS Health
- Amazon Kinesis Data Firehose
- Amazon Kinesis Data Stream
- Amazon MQ
- Amazon Managed Streaming for Apache Kafka (MSK)
- Amazon NAT Gateway
- Amazon RDS
- Amazon Redshift
- Amazon S3
- Amazon S3 Storage Lens
- Amazon Security Lake
- Amazon SNS
- Amazon SQS
- Amazon VPC
- Amazon VPN
- AWS Bedrock
- AWS Billing
- AWS CloudTrail
- AWS CloudWatch
- AWS ELB
- AWS Fargate
- AWS Inspector
- AWS Lambda
- AWS Logs (custom)
- AWS Network Firewall
- AWS Route 53
- AWS Security Hub
- AWS Transit Gateway
- AWS Usage
- AWS WAF
- Azure
- Activity logs
- App Service
- Application Gateway
- Application Insights metrics
- Application Insights metrics overview
- Application State Insights metrics
- Azure logs (v2 preview)
- Azure OpenAI
- Billing metrics
- Container instance metrics
- Container registry metrics
- Container service metrics
- Custom Azure Logs
- Custom Blob Storage Input
- Database Account metrics
- Event Hub input
- Firewall logs
- Frontdoor
- Functions
- Microsoft Entra ID
- Monitor metrics
- Network Watcher VNet
- Network Watcher NSG
- Platform logs
- Resource metrics
- Spring Cloud logs
- Storage Account metrics
- Virtual machines metrics
- Virtual machines scaleset metrics
- Barracuda
- BeyondInsight and Password Safe Integration
- BitDefender
- Bitwarden
- blacklens.io
- Blue Coat Director Logs
- BBOT (Bighuge BLS OSINT Tool)
- Box Events
- Bravura Monitor
- Broadcom ProxySG
- Canva
- Cassandra
- CEL Custom API
- Ceph
- Check Point
- Cilium Tetragon
- CISA Known Exploited Vulnerabilities
- Cisco
- Cisco Meraki Metrics
- Citrix
- Claroty CTD
- Cloudflare
- Cloud Asset Inventory
- CockroachDB Metrics
- Common Event Format (CEF)
- Containerd
- CoreDNS
- Corelight
- Couchbase
- CouchDB
- Cribl
- CrowdStrike
- Cyberark
- Cybereason
- CylanceProtect Logs
- Custom Websocket logs
- Darktrace
- Data Exfiltration Detection
- DGA
- Digital Guardian
- Docker
- DomainTools Real Time Unified Feeds
- Elastic APM
- Elastic Fleet Server
- Elastic Security
- Elastic Stack monitoring
- Elasticsearch Service Billing
- Envoy Proxy
- ESET PROTECT
- ESET Threat Intelligence
- etcd
- Falco
- F5
- File Integrity Monitoring
- FireEye Network Security
- First EPSS
- Forcepoint Web Security
- ForgeRock
- Fortinet
- Gigamon
- GitHub
- GitLab
- Golang
- Google Cloud
- Custom GCS Input
- GCP
- GCP Audit logs
- GCP Billing metrics
- GCP Cloud Run metrics
- GCP CloudSQL metrics
- GCP Compute metrics
- GCP Dataproc metrics
- GCP DNS logs
- GCP Firestore metrics
- GCP Firewall logs
- GCP GKE metrics
- GCP Load Balancing metrics
- GCP Metrics Input
- GCP PubSub logs (custom)
- GCP PubSub metrics
- GCP Redis metrics
- GCP Security Command Center
- GCP Storage metrics
- GCP VPC Flow logs
- GCP Vertex AI
- GoFlow2 logs
- Hadoop
- HAProxy
- Hashicorp Vault
- HTTP Endpoint logs (custom)
- IBM MQ
- IIS
- Imperva
- InfluxDb
- Infoblox
- Iptables
- Istio
- Jamf Compliance Reporter
- Jamf Pro
- Jamf Protect
- Jolokia Input
- Journald logs (custom)
- JumpCloud
- Kafka
- Keycloak
- Kubernetes
- LastPass
- Lateral Movement Detection
- Linux Metrics
- Living off the Land Attack Detection
- Logs (custom)
- Lumos
- Lyve Cloud
- Mattermost
- Memcached
- Menlo Security
- Microsoft
- Microsoft 365
- Microsoft Defender for Cloud
- Microsoft Defender for Endpoint
- Microsoft DHCP
- Microsoft DNS Server
- Microsoft Entra ID Entity Analytics
- Microsoft Exchange Online Message Trace
- Microsoft Exchange Server
- Microsoft Graph Activity Logs
- Microsoft M365 Defender
- Microsoft Office 365 Metrics Integration
- Microsoft Sentinel
- Microsoft SQL Server
- Mimecast
- ModSecurity Audit
- MongoDB
- MongoDB Atlas
- MySQL
- Nagios XI
- NATS
- NetFlow Records
- Netskope
- Network Beaconing Identification
- Network Packet Capture
- Nginx
- Okta
- Oracle
- OpenAI
- OpenCanary
- Osquery
- Palo Alto
- pfSense
- PHP-FPM
- PingOne
- PingFederate
- Pleasant Password Server
- PostgreSQL
- Prometheus
- Proofpoint TAP
- Proofpoint On Demand
- Pulse Connect Secure
- Qualys VMDR
- QNAP NAS
- RabbitMQ Logs
- Radware DefensePro Logs
- Rapid7
- Redis
- Rubrik RSC Metrics Integration
- Sailpoint Identity Security Cloud
- Salesforce
- SentinelOne
- ServiceNow
- Slack Logs
- Snort
- Snyk
- SonicWall Firewall
- Sophos
- Spring Boot
- SpyCloud Enterprise Protection
- SQL Input
- Squid Logs
- SRX
- STAN
- Statsd Input
- Sublime Security
- Suricata
- StormShield SNS
- Symantec
- Symantec Endpoint Security
- Sysmon for Linux
- Sysdig
- Syslog Router Integration
- System
- System Audit
- Tanium
- TCP Logs (custom)
- Teleport
- Tenable
- Threat intelligence
- ThreatConnect
- Threat Map
- Thycotic Secret Server
- Tines
- Traefik
- Trellix
- Trend Micro
- TYCHON Agentless
- UDP Logs (custom)
- Universal Profiling
- Vectra Detect
- VMware
- WatchGuard Firebox
- WebSphere Application Server
- Windows
- Wiz
- Zeek
- ZeroFox
- Zero Networks
- ZooKeeper Metrics
- Zoom
- Zscaler
Azure Compute VM Scaleset Integration
editAzure Compute VM Scaleset Integration
editVersion |
1.7.0 (View all) |
Compatible Kibana version(s) |
8.12.0 or higher |
Supported Serverless project types |
Security |
Subscription level |
Basic |
The Azure Compute Scaleset VM data stream collects and aggregates compute scaleset VM related metrics from Azure Virtual Machine scaleset type resources where it can be used for analysis, visualization, and alerting. The Azure Compute VM Scaleset will periodically retrieve the Azure Monitor metrics using the Azure REST APIs as MetricList. Additional Azure API calls will be executed to retrieve information regarding the resources targeted by the user.
Requirements
editBefore you start, check the Authentication and costs section.
Setup
editFollow these step-by-step instructions on how to set up an Azure metrics integration.
Data stream specific configuration notes
edit-
Period
-
(string) Reporting interval. Metrics will have a timegrain of 5 minutes, so the
Period
configuration option forcompute_vm_scaleset
should have a value of300s
or multiple of `300s`for relevant results. -
Resource IDs
-
([]string) The fully qualified ID’s of the resource, including the resource name and resource type. Has the format
/subscriptions/{guid}/resourceGroups/{resource-group-name}/providers/{resource-provider-namespace}/{resource-type}/{resource-name}
. Should return a list of resources. -
Resource Groups
- ([]string) This option will return all virtual machine scalesets inside the resource group.
If no resource filter is specified, then all virtual machine scalesets inside the entire subscription will be considered.
The primary aggregation value will be retrieved for all the metrics contained in the namespaces. The aggregation options are avg
, sum
, min
, max
, total
, count
.
Exported fields
Field | Description | Type | Unit | Metric Type |
---|---|---|---|---|
@timestamp |
Event timestamp. |
date |
||
agent.id |
Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. |
keyword |
||
azure.application_id |
The application ID |
keyword |
||
azure.compute_vm_scaleset.available_memory_bytes.avg |
Amount of physical memory, in bytes, immediately available for allocation to a process or for system use in the Virtual Machine |
float |
byte |
gauge |
azure.compute_vm_scaleset.cpu_credits_consumed.avg |
Total number of credits consumed by the Virtual Machine. Only available on B-series burstable VMs |
float |
gauge |
|
azure.compute_vm_scaleset.cpu_credits_remaining.avg |
Total number of credits available to burst. Only available on B-series burstable VMs |
float |
gauge |
|
azure.compute_vm_scaleset.data_disk_bandwidth_consumed_percentage.avg |
Percentage of data disk bandwidth consumed per minute |
float |
percent |
gauge |
azure.compute_vm_scaleset.data_disk_queue_depth.avg |
Data Disk Queue Depth(or Queue Length) |
float |
gauge |
|
azure.compute_vm_scaleset.data_disk_read_bytes_per_sec.avg |
Bytes/Sec read from a single disk during monitoring period |
float |
gauge |
|
azure.compute_vm_scaleset.data_disk_read_operations_per_sec.avg |
Read IOPS from a single disk during monitoring period |
float |
gauge |
|
azure.compute_vm_scaleset.data_disk_write_bytes_per_sec.avg |
Bytes/Sec written to a single disk during monitoring period |
float |
gauge |
|
azure.compute_vm_scaleset.data_disk_write_operations_per_sec.avg |
Write IOPS from a single disk during monitoring period |
float |
gauge |
|
azure.compute_vm_scaleset.disk_read_bytes.total |
Bytes read from disk during monitoring period |
float |
byte |
gauge |
azure.compute_vm_scaleset.disk_read_operations_per_sec.avg |
Disk Read IOPS |
float |
gauge |
|
azure.compute_vm_scaleset.disk_write_bytes.total |
Bytes written to disk during monitoring period |
float |
byte |
gauge |
azure.compute_vm_scaleset.disk_write_operations_per_sec.avg |
Disk Write IOPS |
float |
gauge |
|
azure.compute_vm_scaleset.inbound_flows.avg |
Inbound Flows are number of current flows in the inbound direction (traffic going into the VM) |
float |
gauge |
|
azure.compute_vm_scaleset.inbound_flows_maximum_creation_rate.avg |
The maximum creation rate of inbound flows (traffic going into the VM) |
float |
gauge |
|
azure.compute_vm_scaleset.memory_available_bytes.avg |
Available Bytes is the amount of physical memory, in bytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. |
float |
byte |
gauge |
azure.compute_vm_scaleset.memory_commit_limit.avg |
Memory commit limit |
float |
byte |
gauge |
azure.compute_vm_scaleset.memory_committed_bytes.avg |
Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only. |
float |
byte |
gauge |
azure.compute_vm_scaleset.memory_pct_committed_bytes_in_use.avg |
Committed Bytes In Use is the ratio of Memory \ Committed Bytes to the Memory \ Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file. If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This value displays the current percentage value only. |
float |
percent |
gauge |
azure.compute_vm_scaleset.network_in_total.total |
The number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic) |
float |
gauge |
|
azure.compute_vm_scaleset.network_out_total.total |
The number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic) |
float |
gauge |
|
azure.compute_vm_scaleset.os_disk_queue_depth.avg |
OS Disk Queue Depth(or Queue Length) |
float |
gauge |
|
azure.compute_vm_scaleset.os_disk_read_bytes_per_sec.avg |
Bytes/Sec read from a single disk during monitoring period for OS disk |
float |
gauge |
|
azure.compute_vm_scaleset.os_disk_read_operations_per_sec.avg |
Read IOPS from a single disk during monitoring period for OS disk |
float |
gauge |
|
azure.compute_vm_scaleset.os_disk_write_bytes_per_sec.avg |
Bytes/Sec written to a single disk during monitoring period for OS disk |
float |
gauge |
|
azure.compute_vm_scaleset.os_disk_write_operations_per_sec.avg |
Write IOPS from a single disk during monitoring period for OS disk |
float |
gauge |
|
azure.compute_vm_scaleset.outbound_flows.avg |
Outbound Flows are number of current flows in the outbound direction (traffic going out of the VM) |
float |
gauge |
|
azure.compute_vm_scaleset.outbound_flows_maximum_creation_rate.avg |
The maximum creation rate of outbound flows (traffic going out of the VM) |
float |
gauge |
|
azure.compute_vm_scaleset.percentage_cpu.avg |
The percentage of allocated compute units that are currently in use by the Virtual Machine(s) |
float |
percent |
gauge |
azure.dimensions.lun |
Logical Unit Number is a number that is used to identify a specific storage device |
keyword |
||
azure.dimensions.virtual_machine |
The VM name |
keyword |
||
azure.dimensions.vmname |
The VM name |
keyword |
||
azure.namespace |
The namespace selected |
keyword |
||
azure.resource.group |
The resource group |
keyword |
||
azure.resource.id |
The id of the resource |
keyword |
||
azure.resource.name |
The name of the resource |
keyword |
||
azure.resource.tags.* |
Azure resource tags. |
object |
||
azure.resource.type |
The type of the resource |
keyword |
||
azure.subscription_id |
The subscription ID |
keyword |
||
azure.timegrain |
The Azure metric timegrain |
keyword |
||
cloud.account.id |
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. |
keyword |
||
cloud.availability_zone |
Availability zone in which this host is running. |
keyword |
||
cloud.image.id |
Image ID for the cloud instance. |
keyword |
||
cloud.instance.id |
Instance ID of the host machine. |
keyword |
||
cloud.instance.name |
Instance name of the host machine. |
keyword |
||
cloud.machine.type |
Machine type of the host machine. |
keyword |
||
cloud.project.id |
Name of the project in Google Cloud. |
keyword |
||
cloud.provider |
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. |
keyword |
||
cloud.region |
Region in which this host is running. |
keyword |
||
container.id |
Unique container id. |
keyword |
||
container.image.name |
Name of the image the container was built on. |
keyword |
||
container.labels |
Image labels. |
object |
||
container.name |
Container name. |
keyword |
||
container.runtime |
Runtime managing this container. |
keyword |
||
data_stream.dataset |
Data stream dataset name. |
constant_keyword |
||
data_stream.namespace |
Data stream namespace. |
constant_keyword |
||
data_stream.type |
Data stream type. |
constant_keyword |
||
dataset.name |
Dataset name. |
constant_keyword |
||
dataset.namespace |
Dataset namespace. |
constant_keyword |
||
dataset.type |
Dataset type. |
constant_keyword |
||
ecs.version |
ECS version this event conforms to. |
keyword |
||
host |
A host is defined as a general computing instance. ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. |
group |
||
host.architecture |
Operating system architecture. |
keyword |
||
host.containerized |
If the host is a container. |
boolean |
||
host.domain |
Name of the domain of which the host is a member. For example, on Windows this could be the host’s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host’s LDAP provider. |
keyword |
||
host.hostname |
Hostname of the host. It normally contains what the |
keyword |
||
host.id |
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of |
keyword |
||
host.ip |
Host ip addresses. |
ip |
||
host.mac |
Host mac addresses. |
keyword |
||
host.name |
Name of the host. It can contain what |
keyword |
||
host.os.build |
OS build information. |
keyword |
||
host.os.codename |
OS codename, if any. |
keyword |
||
host.os.family |
OS family (such as redhat, debian, freebsd, windows). |
keyword |
||
host.os.kernel |
Operating system kernel version as a raw string. |
keyword |
||
host.os.name |
Operating system name, without the version. |
keyword |
||
host.os.name.text |
Multi-field of |
text |
||
host.os.platform |
Operating system platform (such centos, ubuntu, windows). |
keyword |
||
host.os.version |
Operating system version as a raw string. |
keyword |
||
host.type |
Type of host. For Cloud providers this can be the machine type like |
keyword |
||
service.address |
Service address |
keyword |
||
service.type |
The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, |
keyword |
Changelog
editChangelog
Version | Details | Kibana version(s) |
---|---|---|
1.7.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.9 |
Bug fix (View pull request) |
8.12.0 or higher |
1.6.8 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.7 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.6 |
Bug fix (View pull request) |
8.12.0 or higher |
1.6.5 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.4 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.3 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.2 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.1 |
Enhancement (View pull request) |
8.12.0 or higher |
1.6.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.5.0 |
Enhancement (View pull request) |
8.11.2 or higher |
1.4.4 |
Enhancement (View pull request) |
8.11.2 or higher |
1.4.3 |
Enhancement (View pull request) |
8.11.2 or higher |
1.4.2 |
Enhancement (View pull request) |
8.11.2 or higher |
1.4.1 |
Enhancement (View pull request) |
8.11.2 or higher |
1.4.0 |
Enhancement (View pull request) |
8.11.2 or higher |
1.3.0 |
Enhancement (View pull request) |
8.10.2 or higher |
1.2.1 |
Bug fix (View pull request) |
8.10.2 or higher |
1.2.0 |
Enhancement (View pull request) |
8.10.2 or higher |
1.1.1 |
Enhancement (View pull request) |
8.10.2 or higher |
1.1.0 |
Enhancement (View pull request) |
8.10.2 or higher |
1.0.43 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.42 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.41 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.40 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.39 |
Bug fix (View pull request) |
8.9.0 or higher |
1.0.38 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.37 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.36 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.35 |
Bug fix (View pull request) |
8.9.0 or higher |
1.0.34 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.33 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.32 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.31 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.30 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.29 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.28 |
Enhancement (View pull request) |
8.9.0 or higher |
1.0.27 |
Enhancement (View pull request) |
8.4.0 or higher |
1.0.26 |
Enhancement (View pull request) |
8.4.0 or higher |
1.0.25 |
Enhancement (View pull request) |
8.4.0 or higher |
1.0.24 |
Bug fix (View pull request) |
8.3.0 or higher |
1.0.23 |
Enhancement (View pull request) |
8.3.0 or higher |
1.0.22 |
Enhancement (View pull request) |
8.3.0 or higher |
1.0.21 |
Enhancement (View pull request) |
8.3.0 or higher |
1.0.20 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.19 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.18 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.17 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.16 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.15 |
Bug fix (View pull request) |
7.14.0 or higher |
1.0.14 |
Bug fix (View pull request) |
7.14.0 or higher |
1.0.13 |
Bug fix (View pull request) |
7.14.0 or higher |
1.0.12 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.11 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.10 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.9 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.8 |
Enhancement (View pull request) |
— |
1.0.7 |
Enhancement (View pull request) |
— |
1.0.6 |
Enhancement (View pull request) |
— |
1.0.5 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.4 |
Enhancement (View pull request) |
— |
1.0.3 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.2 |
Enhancement (View pull request) |
— |
1.0.1 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.0 |
Enhancement (View pull request) |
7.14.0 or higher |
0.5.1 |
Enhancement (View pull request) |
— |
0.5.0 |
Enhancement (View pull request) |
— |
0.4.1 |
Enhancement (View pull request) |
— |
0.4.0 |
Enhancement (View pull request) |
— |
0.3.2 |
Enhancement (View pull request) |
— |
0.3.1 |
Enhancement (View pull request) |
— |
0.3.0 |
Enhancement (View pull request) |
— |
0.2.0 |
Enhancement (View pull request) |
— |
0.1.0 |
Enhancement (View pull request) |
— |
0.0.1 |
Enhancement (View pull request) |
— |