Logstash output plugin for sending data to Microsoft Operations Management Suite (OMS)

Summary

This plugin sends Logstash events to the specified Microsoft OMS workspace.

Installation

First, build the plugin gem:

gem build logstash-output-oms.gemspec

You can then install this plugin using the Logstash "plugin" or "logstash-plugin" (for newer versions of Logstash) command:

logstash-plugin install logstash-output-oms-[VERSION].gem

For more information, see Logstash reference Working with plugins.

Testing

First, replace the following variables in spec/outputs/oms_spec.rb with values specific to your OMS workspace:

• let(:workspace_id) { "---- WORKSPACE ID ----" }
• let(:shared_key) { "---- SHARED KEY ----" }
• let(:log_type) { "---- LOG TYPE ----" }

Run the following command:

bundle exec rspec

Configuration

Required Parameters

shared_key

The shared access key to the target workspace.

OR

oms_creds_file

A file containing the shared access key to the target workspace.

AND

workspace_id

The OMS workspace ID.

AND

log_type

The type of logs being sent to OMS.

Examples

output
{
    oms
    {
        shared_key => "XXXXXXXXXXXXXXXXXXX"
        workspace_id => "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        log_type => "syslog"
    }
}

More information

We welcome you to provide feedback and/or contribute to the project.