public override void Ingest(string[] records)
{
// sourceType depends on both the message category and the ResourceType
foreach (var record in records)
{
var expandoConverter = new ExpandoObjectConverter();
var expandoRecord = JsonConvert.DeserializeObject <ExpandoObject>(record, expandoConverter);
var azMonMsg = new AzMonDiagnosticLog(expandoRecord);
var category = "none";
if (((IDictionary <String, Object>)expandoRecord).ContainsKey("category"))
{
category = ((IDictionary <String, Object>)expandoRecord)["category"].ToString();
}
var resourceType = azMonMsg.ResourceType;
if (category != "none")
{
Log.Info($"********* ResourceType: {resourceType}, category: {category} *********");
}
var sourceType = Utils.GetDictionaryValue(resourceType.ToUpper() + "/" + category.ToUpper(), Categories) ?? "amdl:diagnostic";
azMonMsg.SplunkSourceType = sourceType;
azureMonitorMessages.Add(azMonMsg);
}
}
public override void Ingest(string[] records)
{
// Subscription-based: sourceType depends on the message category and the ResourceType
// Tenant-based: sourceType depends on the message category and the ProviderType
foreach (var record in records)
{
var expandoConverter = new ExpandoObjectConverter();
var expandoRecord = JsonConvert.DeserializeObject <ExpandoObject>(record, expandoConverter);
var azMonMsg = new AzMonDiagnosticLog(expandoRecord);
var category = "none";
if (((IDictionary <String, Object>)expandoRecord).ContainsKey("category"))
{
category = ((IDictionary <String, Object>)expandoRecord)["category"].ToString();
}
var resourceType = azMonMsg.ResourceType;
var providerName = azMonMsg.ProviderName;
var logMessage = "";
var sourceType = "";
if (azMonMsg.TenantId.Length > 0)
{
logMessage = $"********* ProviderName: {providerName}";
sourceType = Utils.GetDictionaryValue(providerName.ToUpper() + "/" + category.ToUpper(), Categories) ?? "amdl:diagnostic";
}
else
{
logMessage = $"********* ResourceType: {resourceType}";
sourceType = Utils.GetDictionaryValue(resourceType.ToUpper() + "/" + category.ToUpper(), Categories) ?? "amdl:diagnostic";
}
// log categories that aren't yet in the DiagnosticLogCategories.json file.
if (category != "none" && sourceType == "amdl:diagnostic")
{
Log.LogInformation($"{logMessage}, category: {category} *********");
}
azMonMsg.SplunkSourceType = sourceType;
azureMonitorMessages.Add(azMonMsg);
}
}
public override void Ingest(string[] records)
{
// sourceType depends on the ResourceType
foreach (var record in records)
{
var expandoConverter = new ExpandoObjectConverter();
var expandoRecord = JsonConvert.DeserializeObject <ExpandoObject>(record, expandoConverter);
var azMonMsg = new AzMonDiagnosticLog(expandoRecord);
var resourceType = azMonMsg.ResourceType;
var sourceType = Utils.GetDictionaryValue(resourceType, Categories) ?? "amm:metrics";
azMonMsg.SplunkSourceType = sourceType;
azureMonitorMessages.Add(azMonMsg);
}
}