<p>How to send AKS master logs to eventhub using Azurerm terraform ? As Terraform only provides log analytics option only.</p>

Hetal Sonavane
<p>In order to send logs to Event Hub using terraform you need to create few resources :</p>
<ol>
<li>Event Hub Namespace (<a href="https://www.terraform.io/docs/providers/azurerm/r/eventhub_namespace.html" rel="noreferrer"><code>azurerm_eventhub_namespace</code></a>)</li>
<li>Event Hub (<a href="https://www.terraform.io/docs/providers/azurerm/r/eventhub.html" rel="noreferrer"><code>azurerm_eventhub</code></a>)</li>
<li>Authorization Rule for an Event Hub Namespace (<a href="https://www.terraform.io/docs/providers/azurerm/r/eventhub_namespace_authorization_rule.html" rel="noreferrer"><code>azurerm_eventhub_namespace_authorization_rule</code></a>)</li>
<li>Diagnostic Setting for an existing Resource (<a href="https://www.terraform.io/docs/providers/azurerm/r/monitor_diagnostic_setting.html" rel="noreferrer"><code>azurerm_monitor_diagnostic_setting</code></a>)</li>
</ol>
<p>The following example based on <a href="https://github.com/brusMX/promitor-tests/tree/8b84c051b50f87bdf2bfb2031277c69576e47cce/logstash/terraform" rel="noreferrer">this repo</a>.</p>
<pre class="lang-sh prettyprint-override"><code>
# Create the AKS cluster

resource &quot;azurerm_resource_group&quot; &quot;example&quot; {
  name     = &quot;example-resources&quot;
  location = &quot;West Europe&quot;
}

resource &quot;azurerm_kubernetes_cluster&quot; &quot;example&quot; {
  name                = &quot;example-aks1&quot;
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = &quot;exampleaks1&quot;

  default_node_pool {
    name       = &quot;default&quot;
    node_count = 1
    vm_size    = &quot;Standard_D2_v2&quot;
  }

  identity {
    type = &quot;SystemAssigned&quot;
  }

  tags = {
    Environment = &quot;Production&quot;
  }
}

# Create Event hub namespace

resource &quot;azurerm_eventhub_namespace&quot; &quot;logging&quot; {
  name                = &quot;logging-eventhub&quot;
  location            = &quot;${azurerm_resource_group.example.location}&quot;
  resource_group_name = &quot;${azurerm_resource_group.example.name}&quot;
  sku                 = &quot;Standard&quot;
  capacity            = 1
  kafka_enabled       = false
}


# Create Event hub

resource &quot;azurerm_eventhub&quot; &quot;logging_aks&quot; {
  name                = &quot;logging-aks-eventhub&quot;
  namespace_name      = &quot;${azurerm_eventhub_namespace.logging.name}&quot;
  resource_group_name = &quot;${azurerm_resource_group.example.name}&quot;
  partition_count     = 2
  message_retention   = 1
}

# Create an authorization rule

resource &quot;azurerm_eventhub_namespace_authorization_rule&quot; &quot;logging&quot; {
  name                = &quot;authorization_rule&quot;
  namespace_name      = &quot;${azurerm_eventhub_namespace.logging.name}&quot;
  resource_group_name = &quot;${azurerm_resource_group.example.name}&quot;

  listen = true
  send   = true
  manage = true
}

# Manages a Diagnostic Setting for an existing Resource

resource &quot;azurerm_monitor_diagnostic_setting&quot; &quot;aks-logging&quot; {
  name                           = &quot;diagnostic_aksl&quot;
  target_resource_id             = &quot;${azurerm_kubernetes_cluster.example.id}&quot;
  eventhub_name                  = &quot;${azurerm_eventhub.logging_aks.name}&quot;
  eventhub_authorization_rule_id = &quot;${azurerm_eventhub_namespace_authorization_rule.logging.id}&quot;

  log {
    category = &quot;kube-scheduler&quot;
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = &quot;kube-controller-manager&quot;
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = &quot;cluster-autoscaler&quot;
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = &quot;kube-audit&quot;
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = &quot;kube-apiserver&quot;
    enabled  = true

    retention_policy {
      enabled = false
    }
  }
}

</code></pre>
