Deploy EDOT Cloud Forwarder for Azure
Follow these steps to deploy EDOT Cloud Forwarder for Azure in a resource group to send telemetry data to the Elastic Cloud Managed OTLP Endpoint endpoint.
You can deploy EDOT Cloud Forwarder for Azure automatically with Deploy to Azure:
This opens the Azure portal with the Bicep template pre-filled. You can then configure the parameters and deploy the template. In the Essentials step, the Encoding section lets you select the logs encoding mode. You can also download the EDOT Cloud Forwarder for Azure Bicep template.
-
Create the resource group
Create the resource group that hosts all the resources for EDOT Cloud Forwarder for Azure.
az group create --name <resource_group_name> --location <azure_region> -
Download the Bicep template
-
Deploy the Bicep template
Deploy the Bicep template using the following command:
az deployment group create \ --resource-group <resource_group_name> \ --template-file ecf.bicep \ --parameters \ otlpEndpoint=<otlp_endpoint> \ elasticApiKey=<elastic_api_key> \ logsEncodingExtension=<encoding> \- The OTLP endpoint is the URL of the Elasticsearch OTLP endpoint. Refer to Prerequisites.
- The Elastic API key is the API key for authentication. Refer to Prerequisites.
- Optional. The logs encoding extension to use. Use
azure_encoding(default) for OTel Native format, orbeats_encodingfor ECS format.
For a complete list of parameters, refer to Configure EDOT Cloud Forwarder for Azure.
Once EDOT Cloud Forwarder for Azure is deployed, configure the Azure side to stream telemetry to the Event Hubs created by the deployment. Each signal has its own setup steps:
- Logs — set up Diagnostic Settings to stream Activity logs and resource logs.
- Metrics — set up Data Collection Rules or Diagnostic Settings for platform metrics.
To upgrade an existing EDOT Cloud Forwarder for Azure deployment to a later version, refer to Upgrade EDOT Cloud Forwarder for Azure.
If you no longer need the resources and want to remove them, use the following command:
az group delete --name <resource_group_name>
This removes all the resources in the resource group.
If you remove the resource group, data that's still unprocessed will be lost.