Azure Monitor

Technical Preview

Overview

A client-mode connector for a curated observability / ITSM slice of Azure Monitor:

Catalog connector event	Entity / path	Notes
POST logs to DCR stream	`POST /dataCollectionRules/{dcr}/streams/{stream}?api-version=2023-01-01`	Logs Ingestion on DCE/DCR host; scope `https://monitor.azure.com/.default`; expect 204
POST custom metric	`POST /{resourceId}/metrics`	Host `https://{region}.monitoring.azure.com`; scope `https://monitoring.azure.com/.default`; expect 200
POST KQL query	`POST /v1/workspaces/{workspaceId}/query`	Host `https://api.loganalytics.azure.com`; scope `https://api.loganalytics.io/.default`; auth smoke → 200
GET KQL query	`GET /v1/workspaces/{workspaceId}/query`	Same query API via query string
Action Group / alert webhook	inbound HTTP	ENABLE_SERVER companion (docs only — not in this client `.lot`)

Default BASE_ADDRESS is https://YOUR_DCE.ingest.monitor.azure.com. Topics use itsm/azure-monitor/<object>/<verb>. Switch BASE per surface (Logs / Metrics / Query) the same way other multi-host connectors do.

Replace YOUR_DCE with your Data Collection Endpoint hostname (or use the DCR logsIngestion endpoint). Prefer Hub secrets for Entra client credentials and workspace / DCR / resource identifiers. This template has not been verified against a live Azure subscription. Status remains blocked until an authenticated live smoke succeeds.

Basic Syntax

# Coreflux REST_API template — Azure Monitor (Logs + Metrics + KQL)
# Auth: Authorization: Bearer {value.json.access_token}
# BASE_ADDRESS: https://YOUR_DCE.ingest.monitor.azure.com

DEFINE ROUTE AzureMonitorRestApi WITH TYPE REST_API
    ADD REST_API_CONFIG
        WITH BASE_ADDRESS "https://YOUR_DCE.ingest.monitor.azure.com"
        WITH ENABLE_CLIENT "true"
        WITH USE_SSL "true"
        WITH REQUEST_TIMEOUT '60'
        WITH DEFAULT_CONTENT_TYPE "application/json"
    ADD EVENT Uploadlogs
        WITH SOURCE_TOPIC "itsm/azure-monitor/log/ingest"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/log/ingest/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/dataCollectionRules/{value.json.dcr_immutable_id}/streams/{value.json.stream_name}?api-version={value.json.api_version}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
            ADD "x-ms-client-request-id" "{value.json.client_request_id}"
        WITH BODY "{payload}"
    ADD EVENT Createcustommetric
        WITH SOURCE_TOPIC "itsm/azure-monitor/metric/custom"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/metric/custom/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/{value.json.resource_id}/metrics"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
        WITH BODY "{payload}"
    ADD EVENT Executequery
        WITH SOURCE_TOPIC "itsm/azure-monitor/query/execute"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/query/execute/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/v1/workspaces/{value.json.workspace_id}/query"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
        WITH BODY "{payload}"
    ADD EVENT Executequeryget
        WITH SOURCE_TOPIC "itsm/azure-monitor/query/get"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/query/get/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/v1/workspaces/{value.json.workspace_id}/query?query={value.json.query}&timespan={value.json.timespan}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"

Authentication

Mode	Header	Notes
Entra OAuth 2.0 client credentials	`Authorization: Bearer {value.json.access_token}`	Default in this template

Acquire tokens from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token. Scopes: https://monitor.azure.com/.default (logs), https://monitoring.azure.com/.default (custom metrics), https://api.loganalytics.io/.default (query). Store tenant / client / secret in Hub secrets (AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET) and resolve via GET SECRET — never commit credentials.

MQTT examples

Logs ingest (JSON array; BASE = DCE):

[
  {
    "Time": "2026-10-04T17:00:00Z",
    "Computer": "line-a",
    "AdditionalContext": "vibration_rms=12.4"
  }
]

Publish with access_token, dcr_immutable_id, stream_name, and api_version (2023-01-01). Expect HTTP 204. Custom metric (BASE = {region}.monitoring.azure.com):

{
  "time": "2026-10-04T17:00:00Z",
  "data": {
    "baseData": {
      "metric": "vibration_rms",
      "namespace": "Coreflux/Plant",
      "series": [{"min": 12.4, "max": 12.4, "sum": 12.4, "count": 1}]
    }
  }
}

Expect HTTP 200. KQL query (BASE = api.loganalytics.azure.com):

{
  "query": "AzureActivity | summarize count() by Category",
  "timespan": "PT12H"
}

Expect HTTP 200.

Action Group webhook companion

Azure Monitor Action Groups can deliver Common Alert Schema (or older schemas) to a webhook URL. Package a separate ENABLE_SERVER true REST_API connector to receive those POSTs on an MQTT-bound path. That inbound surface is not included in AzureMonitorRestApi.lot.

Sources

Package

Broker template folder: src/CorefluxCentral/Routes/Templates/RestApiConnectors/azure-monitor/ Deployable file: AzureMonitorRestApi.lot (no ADD METADATA). Hub icon/status: hub-metadata.lot.

Quick Start

Coreflux MQTT Broker

LoT Language

Coreflux HUB

VS Code - LoT Notebooks

Coreflux Portal

Using AI with Coreflux

Product Updates

Overview

Basic Syntax

Authentication

MQTT examples

Action Group webhook companion

Sources

Package

​Overview

​Basic Syntax

​Authentication

​MQTT examples

​Action Group webhook companion

​Sources

​Package

Overview

Basic Syntax

Authentication

MQTT examples

Action Group webhook companion

Sources

Package