---
title: Azure resource logs
description: Export Azure resource logs to an Event Hub through diagnostic settings, and forward them to Coralogix with the Event Hub integration.
url: https://coralogix.com/docs/integrations/azure/azure-resource-logs/
product: ingress
feature: Azure Logs Ingress
feature_id: logs.azure-ingress
feature_identifier: ingress/logs.azure-ingress
last_updated: '2026-09-03'
---

# Azure resource logs

Resource logs (previously called diagnostic logs) record what happened *inside* an Azure resource: a connection to a PostgreSQL server, a blob created or deleted in a storage account. That is the data plane, as distinct from the [activity logs](https://coralogix.com/docs/integrations/azure/azure-activity-logs.md) that record operations performed *on* resources. Their contents vary by Azure service and resource type.

Getting them into Coralogix takes two moves: a diagnostic setting that streams the logs to an Event Hub, and the [Event Hub integration](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md) that forwards from there.

## What you need

* An Azure account with an active subscription.
* An Event Hub namespace. If yours restricts public access, enable VNet support first. See the [optional configuration steps](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md).

Note

Not every resource type produces audit logs. The example below uses a PostgreSQL database.

## Export the logs to an Event Hub

1

<!-- -->

.

Open diagnostic settings

Navigate to the resource, then select **Diagnostic settings** under **Monitoring**.

2

<!-- -->

.

Add a setting

Select **Add diagnostic setting** and give it a name.

3

<!-- -->

.

Pick the categories and destination

Select the **audit** category group, then under **Destination details** select **Stream to an event hub** and choose your subscription, namespace, event hub, and policy. Select **Save**.

[![Azure Diagnostic setting page with the audit category group selected and Stream to an event hub configured](/docs/assets/images/Untitled-30-1024x783-1c651de1eb1ec6bea9a2c98f795d3224.webp)](https://coralogix.com/docs/assets/images/Untitled-30-1024x783-1c651de1eb1ec6bea9a2c98f795d3224.webp)

Shows the log categories on the left and the Event Hub destination on the right.

## Forward from the Event Hub

Deploy the Azure Event Hub integration to collect the messages and submit them to Coralogix. Two deployment paths are available:

| Path                                                                                                                              | Use                         |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| [Azure Event Hub ARM](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md)                | Deploy from an ARM template |
| [ARM Event Hub integration package](https://coralogix.com/docs/integrations/azure/azure-resource-manager-integration-packages.md) | Deploy the packaged version |
| [Azure Event Hub Terraform](https://coralogix.com/docs/integrations/azure/azure-event-hub-terraform-module.md)                    | Deploy with Terraform       |

Warning

Restart the function after deploying. It does not pick up the new diagnostic setting until it restarts.

## Related resources

[Introduction to Microsoft Azure](https://coralogix.com/docs/integrations/azure/introduction-to-microsoft-azure.md)[Azure activity logs](https://coralogix.com/docs/integrations/azure/azure-activity-logs.md)[Optional Azure configurations](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md)