> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreflux.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Monitor

> Client-mode REST API connector for a curated Azure Monitor slice: Logs Ingestion (DCR stream), Custom Metrics REST, and Log Analytics KQL query from MQTT; Action Group webhook is an ENABLE_SERVER companion

Technical Preview

## Overview

A client-mode connector for a **curated observability / ITSM** slice of [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/):

| Catalog connector event | Entity / path | Notes |
| - | - | - |
| POST logs to DCR stream | `POST /dataCollectionRules/{dcr}/streams/{stream}?api-version=2023-01-01` | Logs Ingestion on DCE/DCR host; scope `https://monitor.azure.com/.default`; expect **204** |
| POST custom metric | `POST /{resourceId}/metrics` | Host `https://{region}.monitoring.azure.com`; scope `https://monitoring.azure.com/.default`; expect **200** |
| POST KQL query | `POST /v1/workspaces/{workspaceId}/query` | Host `https://api.loganalytics.azure.com`; scope `https://api.loganalytics.io/.default`; auth smoke → **200** |
| GET KQL query | `GET /v1/workspaces/{workspaceId}/query` | Same query API via query string |
| Action Group / alert webhook | inbound HTTP | **ENABLE\_SERVER companion** (docs only — not in this client `.lot`) |

Default `BASE_ADDRESS` is `https://YOUR_DCE.ingest.monitor.azure.com`. Topics use `itsm/azure-monitor/<object>/<verb>`. Switch BASE per surface (Logs / Metrics / Query) the same way other multi-host connectors do.

> [!NOTE]
>
> Replace `YOUR_DCE` with your Data Collection Endpoint hostname (or use the DCR `logsIngestion` endpoint). Prefer Hub secrets for Entra client credentials and workspace / DCR / resource identifiers. This template has not been verified against a live Azure subscription. Status remains blocked until an authenticated live smoke succeeds.

## Basic Syntax

```lot wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
# Coreflux REST_API template — Azure Monitor (Logs + Metrics + KQL)
# Auth: Authorization: Bearer {value.json.access_token}
# BASE_ADDRESS: https://YOUR_DCE.ingest.monitor.azure.com

DEFINE ROUTE AzureMonitorRestApi WITH TYPE REST_API
    ADD REST_API_CONFIG
        WITH BASE_ADDRESS "https://YOUR_DCE.ingest.monitor.azure.com"
        WITH ENABLE_CLIENT "true"
        WITH USE_SSL "true"
        WITH REQUEST_TIMEOUT '60'
        WITH DEFAULT_CONTENT_TYPE "application/json"
    ADD EVENT Uploadlogs
        WITH SOURCE_TOPIC "itsm/azure-monitor/log/ingest"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/log/ingest/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/dataCollectionRules/{value.json.dcr_immutable_id}/streams/{value.json.stream_name}?api-version={value.json.api_version}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
            ADD "x-ms-client-request-id" "{value.json.client_request_id}"
        WITH BODY "{payload}"
    ADD EVENT Createcustommetric
        WITH SOURCE_TOPIC "itsm/azure-monitor/metric/custom"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/metric/custom/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/{value.json.resource_id}/metrics"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
        WITH BODY "{payload}"
    ADD EVENT Executequery
        WITH SOURCE_TOPIC "itsm/azure-monitor/query/execute"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/query/execute/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/v1/workspaces/{value.json.workspace_id}/query"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
        WITH BODY "{payload}"
    ADD EVENT Executequeryget
        WITH SOURCE_TOPIC "itsm/azure-monitor/query/get"
        WITH DESTINATION_TOPIC "itsm/azure-monitor/query/get/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/v1/workspaces/{value.json.workspace_id}/query?query={value.json.query}&timespan={value.json.timespan}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Authorization" "Bearer {value.json.access_token}"
```

## Authentication

| Mode | Header | Notes |
| - | - | - |
| Entra OAuth 2.0 client credentials | `Authorization: Bearer {value.json.access_token}` | Default in this template |

Acquire tokens from `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token`. Scopes: `https://monitor.azure.com/.default` (logs), `https://monitoring.azure.com/.default` (custom metrics), `https://api.loganalytics.io/.default` (query). Store tenant / client / secret in Hub secrets (`AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`) and resolve via `GET SECRET` — never commit credentials.

## MQTT examples

**Logs ingest** (JSON array; BASE = DCE):

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
[
  {
    "Time": "2026-10-04T17:00:00Z",
    "Computer": "line-a",
    "AdditionalContext": "vibration_rms=12.4"
  }
]
```

Publish with `access_token`, `dcr_immutable_id`, `stream_name`, and `api_version` (`2023-01-01`). Expect **HTTP 204**.

**Custom metric** (BASE = `{region}.monitoring.azure.com`):

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{
  "time": "2026-10-04T17:00:00Z",
  "data": {
    "baseData": {
      "metric": "vibration_rms",
      "namespace": "Coreflux/Plant",
      "series": [{"min": 12.4, "max": 12.4, "sum": 12.4, "count": 1}]
    }
  }
}
```

Expect **HTTP 200**.

**KQL query** (BASE = `api.loganalytics.azure.com`):

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{
  "query": "AzureActivity | summarize count() by Category",
  "timespan": "PT12H"
}
```

Expect **HTTP 200**.

## Action Group webhook companion

Azure Monitor Action Groups can deliver Common Alert Schema (or older schemas) to a webhook URL. Package a separate `ENABLE_SERVER true` REST\_API connector to receive those POSTs on an MQTT-bound path. That inbound surface is **not** included in `AzureMonitorRestApi.lot`.

## Sources

* [Logs Ingestion API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview)
* [Custom metrics REST](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-store-custom-rest-api)
* [Metrics - Custom - Create](https://learn.microsoft.com/en-us/rest/api/monitor/metrics-custom/create)
* [Logs query API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/overview)
* [API access and authentication](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api)
* [Action groups](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups)

## Package

Broker template folder: `src/CorefluxCentral/Routes/Templates/RestApiConnectors/azure-monitor/`

Deployable file: `AzureMonitorRestApi.lot` (no `ADD METADATA`). Hub icon/status: `hub-metadata.lot`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.