Azure Monitor

Azure Monitor cannot send diagnostic logs to an HTTPS endpoint directly. Stream them to Azure Event Hubs, and let a small Azure Function post them to the Squasher drain endpoint.

Prerequisites

An Azure Event Hubs namespace and event hub.
An Azure Function App with the Node.js runtime.
An ingest key and the project ID, saved as the app settings SQUASHER_API_KEY and SQUASHER_PROJECT_ID. See Create an ingest key.

Set up the drain

Stream the logs to Event Hubs

In the Azure portal, open the resource and select Diagnostic settings under Monitoring.
Select Add diagnostic setting.
Choose the log categories, choose your event hub as the destination, and save.

Deploy the forwarder function

Azure sends each batch as an object with a records array. The function turns each record into one JSON line with the fields that Squasher reads.

src/functions/squasher-forwarder.ts

import { app } from "@azure/functions";

type AzureRecord = {
  time?: string;
  category?: string;
  level?: string;
  operationName?: string;
  properties?: { message?: string };
};

const endpoint = `https://ingest.squasher.ai/v1/drain/azure/${process.env.SQUASHER_PROJECT_ID}`;

app.eventHub("squasher-forwarder", {
  connection: "EVENT_HUB_CONNECTION",
  eventHubName: "insights-logs",
  cardinality: "many",
  handler: async (messages: Array<string | { records?: AzureRecord[] }>) => {
    const lines = messages
      .map((message) => (typeof message === "string" ? JSON.parse(message) : message))
      .flatMap((batch: { records?: AzureRecord[] }) => batch.records ?? [])
      .map((record) =>
        JSON.stringify({
          message: record.properties?.message ?? record.operationName ?? JSON.stringify(record),
          level: (record.level ?? "info").toLowerCase(),
          timestamp: record.time,
          service: record.category ?? "azure",
        }),
      );
    if (lines.length === 0) return;
    const response = await fetch(endpoint, {
      method: "POST",
      headers: { "x-squasher-key": process.env.SQUASHER_API_KEY ?? "" },
      body: lines.join("\n"),
    });
    if (!response.ok) throw new Error(`Squasher returned ${response.status}`);
  },
});

Set EVENT_HUB_CONNECTION to the event hub connection string, and eventHubName to your event hub.

What Squasher keeps from each record

Azure field	Squasher field
`properties.message`, or `operationName`	Log body and issue title
`level` (`Error`, `Critical`, `Warning`)	Level. `Error` and `Critical` create issues.
`time`	Time
`category`	Service name
`resourceId` and other `properties`	Dropped, unless you add them to the message

The function decides what Squasher receives. See the drain record format for every field that Squasher reads.

Verify

Cause one error in the Azure resource, or wait for a diagnostic log.
In the function’s logs, check that each run ends without an error.
In Squasher, select Logs in the sidebar. The lines appear with the category as the service. Error lines also appear in Issues.

Limits

Azure levels such as Informational are stored as info.
Drain records have no environment, so automatic AI triage does not run on their issues.
If Squasher answers 429 or 503, the function throws. Add a retry policy to the function so that it sends the batch again.

Get started

Guides

Prerequisites

Set up the drain

What Squasher keeps from each record

Verify

Limits

Next steps

Drain record format

OpenTelemetry

​Prerequisites

​Set up the drain

​What Squasher keeps from each record

​Verify

​Limits

​Next steps

Drain record format

OpenTelemetry

Prerequisites

Set up the drain

What Squasher keeps from each record

Verify

Limits

Next steps