61-65

cloud.azure.hostpools
cloud.azure.hostpools.agenthealthstatus
cloud.azure.hostpools.checkpoint
cloud.azure.hostpools.connection
cloud.azure.hostpools.error

tag61cloud.azure.hostpools

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
type	`str`	vtype
host_Ring	`str`
Level	`str`
ActivityId	`str`
time	`str`
resourceId	`str`
operationName	`str`
category	`str`
properties_SessionHostName	`str`
properties_SessionHostResourceId	`str`
properties_AgentVersion	`str`
properties_OsVersion	`str`
properties_SxSStackVersion	`str`
properties_LastHeartBeat	`str`
properties_EndpointState	`str`
properties_UpgradeState	`str`
properties_UpgradeErrorMsg	`str`
properties_LastUpgradeTimeStamp	`str`
properties_SessionHostHealthCheckResult	`str`
properties_ActiveSessions	`str`
properties_InactiveSessions	`str`
properties_State	`str`
properties_ClientOS	`str`
properties_ClientVersion	`str`
properties_ClientType	`str`
properties_PlatformName	`str`
properties_PlatformVersion	`str`
properties_PredecessorConnectionId	`str`
properties_ResourceType	`str`
properties_ResourceAlias	`str`
properties_SessionHostAzureVmId	`str`
properties_SessionHostIPAddress	`ip4`
properties_SessionHostAgentVersion	`str`
properties_SessionHostOSDescription	`str`
properties_SessionHostOSVersion	`str`
properties_SessionHostSxSStackVersion	`str`
properties_SessionHostSessionId	`str`
properties_AadTenantId	`str`
properties_GatewayRegion	`str`
properties_UdpUse	`str`
properties_Name	`str`
properties_Source	`str`
properties_Parameters	`str`
properties_ActivityType	`str`
properties_Code	`str`
properties_CodeSymbolic	`str`
properties_Message	`str`
properties_ServiceError	`str`
properties_Route	`str`
properties_ObjectsFetched	`str`
properties_ObjectsCreated	`str`
properties_ObjectsUpdated	`str`
properties_ObjectsDeleted	`str`
resultType	`str`
durationMs	`int4`
callerIpAddress	`ip4`
correlationId	`str`
identity_UserName	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

tag62cloud.azure.hostpools.agenthealthstatus

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
host_Ring	`str`
Level	`str`
ActivityId	`str`
time	`str`
resourceId	`str`
operationName	`str`
category	`str`
properties_SessionHostName	`str`
properties_SessionHostResourceId	`str`
properties_AgentVersion	`str`
properties_OsVersion	`str`
properties_SxSStackVersion	`str`
properties_LastHeartBeat	`str`
properties_EndpointState	`str`
properties_UpgradeState	`str`
properties_UpgradeErrorMsg	`str`
properties_LastUpgradeTimeStamp	`str`
properties_SessionHostHealthCheckResult	`str`
properties_ActiveSessions	`str`
properties_InactiveSessions	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag63cloud.azure.hostpools.checkpoint

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
host_Ring	`str`
Level	`str`
ActivityId	`str`
time	`str`
resourceId	`str`
operationName	`str`
category	`str`
properties_Name	`str`
properties_Source	`str`
properties_Parameters	`str`
resultType	`str`
durationMs	`int4`
correlationId	`str`
identity_UserName	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag64cloud.azure.hostpools.connection

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
host_Ring	`str`
ActivityId	`str`
time	`str`
resourceId	`str`
operationName	`str`
category	`str`
properties_State	`str`
properties_ClientOS	`str`
properties_ClientVersion	`str`
properties_ClientType	`str`
properties_PlatformName	`str`
properties_PlatformVersion	`str`
properties_PredecessorConnectionId	`str`
properties_ResourceType	`str`
properties_ResourceAlias	`str`
properties_SessionHostName	`str`
properties_SessionHostAzureVmId	`str`
properties_SessionHostIPAddress	`ip4`
properties_SessionHostAgentVersion	`str`
properties_SessionHostOSDescription	`str`
properties_SessionHostOSVersion	`str`
properties_SessionHostSxSStackVersion	`str`
properties_SessionHostSessionId	`str`
properties_AadTenantId	`str`
properties_GatewayRegion	`str`
properties_UdpUse	`str`
resultType	`str`
durationMs	`int4`
callerIpAddress	`ip4`
correlationId	`str`
identity_UserName	`str`
Level	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag65cloud.azure.hostpools.error

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
host_Ring	`str`
ActivityId	`str`
time	`str`
resourceId	`str`
operationName	`str`
category	`str`
properties_ActivityType	`str`
properties_Source	`str`
properties_Code	`str`
properties_CodeSymbolic	`str`
properties_Message	`str`
properties_ServiceError	`str`
resultType	`str`
durationMs	`int4`
correlationId	`str`
identity_UserName	`str`
Level	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

66-70

cloud.azure.hostpools.management
cloud.azure.keyvault.administrative
cloud.azure.keyvault.audit
cloud.azure.keyvault.azure_monitor
cloud.azure.keyvault.policy

tag66cloud.azure.hostpools.management

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
host_Ring	`str`
ActivityId	`str`
resourceId	`str`
operationName	`str`
category	`str`
properties_Route	`str`
properties_ObjectsFetched	`str`
properties_ObjectsCreated	`str`
properties_ObjectsUpdated	`str`
properties_ObjectsDeleted	`str`
resultType	`str`
durationMs	`int4`
callerIpAddress	`ip4`
correlationId	`str`
identity_UserName	`str`
Level	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag67cloud.azure.keyvault.administrative

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
roleLocation	`str`
timestamp	`timestamp`	time
resourceId	`str`
operationName	`str`
category	`str`
resultType	`str`
resultSignature	`str`
durationMs	`str`
callerIpAddress	`ip4`
correlationId	`str`
identity__authorization__scope	`str`
identity__authorization__action	`str`
identity__authorization__evidence__role	`str`
identity__authorization__evidence__roleAssignmentScope	`str`
identity__authorization__evidence__roleAssignmentId	`str`
identity__authorization__evidence__roleDefinitionId	`str`
identity__authorization__evidence__principalId	`str`
identity__authorization__evidence__principalType	`str`
identity__claims	`json`
identity__claims__aud	`str`
identity__claims__iss	`str`
identity__claims__iat	`str`
identity__claims__nbf	`str`
identity__claims__exp	`str`
identity__claims__aio	`str`
identity__claims__appid	`str`
identity__claims__appidacr	`str`
identity__claims__groups	`str`
identity__claims__rh	`str`
identity__claims__uti	`str`
identity__claims__ver	`str`
identity__claims__xms_mirid	`str`
identity__claims__xms_tcdt	`str`
level	`str`
properties__statusCode	`str`
properties__serviceRequestId	`str`
properties__eventCategory	`str`
properties__entity	`str`
properties__message	`str`
properties__hierarchy	`str`
tenantId	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

tag68cloud.azure.keyvault.audit

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
timestamp	`timestamp`	time
category	`str`
operationName	`str`
resultType	`str`
correlationId	`str`
callerIpAddress	`ip4`
identity__claim	`json`
identity__claim__appid	`str`
properties__id	`str`
properties__clientInfo	`str`
properties__httpStatusCode	`int4`
properties__requestUri	`str`
properties__isAccessPolicyMatch	`bool`
properties__subnetId	`str`
properties__isAddressAuthorized	`bool`
properties__addrAuthType	`str`
resourceId	`str`
operationVersion	`str`
resultSignature	`str`
durationMs	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

tag69cloud.azure.keyvault.azure_monitor

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
average	`int4`
total	`int4`
resourceId	`str`
timeGrain	`str`
metricName	`str`
count	`int4`
maximum	`int4`
time	`str`
minimum	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag70cloud.azure.keyvault.policy

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
roleLocation	`str`
timestamp	`timestamp`
resourceId	`str`
operationName	`str`
category	`str`
resultType	`str`
resultSignature	`str`
durationMs	`str`
callerIpAddress	`ip4`
correlationId	`str`
identity__authorization__scope	`str`
identity__authorization__action	`str`
identity__authorization__evidence__role	`str`
identity__authorization__evidence__roleAssignmentScope	`str`
identity__authorization__evidence__roleAssignmentId	`str`
identity__authorization__evidence__roleDefinitionId	`str`
identity__authorization__evidence__principalId	`str`
identity__authorization__evidence__principalType	`str`
identity__claims	`json`
identity__claims__aud	`str`
identity__claims__iss	`str`
identity__claims__iat	`str`
identity__claims__nbf	`str`
identity__claims__exp	`str`
identity__claims__aio	`str`
identity__claims__appid	`str`
identity__claims__appidacr	`str`
identity__claims__rh	`str`
identity__claims__uti	`str`
identity__claims__ver	`str`
identity__claims__xms_tcdt	`str`
level	`str`
properties__isComplianceCheck	`str`
properties__resourceLocation	`str`
properties__ancestors	`str`
properties__policies	`json`
properties__createdResources	`json`
properties__updatedResources	`json`
properties__deplymentProvisioningState	`str`
properties__deploymentId	`str`
properties__eventCategory	`str`
properties__entity	`str`
properties__message	`str`
properties__hierarchy	`str`
tenantId	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

71-75

cloud.azure.keyvault.policy_evaluation_details
cloud.azure.managedclusters
cloud.azure.managedclusters.cloud_controller_manager
cloud.azure.managedclusters.csi_azuredisk_controller
cloud.azure.managedclusters.csi_azurefile_controller

tag71cloud.azure.keyvault.policy_evaluation_details

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
timestamp	`timestamp`
category	`str`
operationName	`str`
resultType	`str`
identity	`json`
properties	`json`
properties__objectName	`str`
properties__objectType	`str`
properties__isComplianceCheck__bool	`bool`
properties__evaluationDetails	`json`
properties__evaluationDetails__assignmentId	`str`	properties__evaluationDetails__assignmentId__arr
properties__evaluationDetails__assignmentDisplayName	`str`	properties__evaluationDetails__assignmentDisplayName__arr
properties__evaluationDetails__definitionId	`str`	properties__evaluationDetails__definitionId__arr
properties__evaluationDetails__definitionDisplayName	`str`	properties__evaluationDetails__definitionDisplayName__arr
properties__evaluationDetails__outcome	`str`	properties__evaluationDetails__outcome__arr
properties__evaluationDetails__expressionEvaluationDetails	`str`	properties__evaluationDetails__expressionEvaluationDetails__arr
resourceId	`str`
durationMs	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

tag73cloud.azure.managedclusters.cloud_controller_manager

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
attrs	`str`
operation_name	`str`
category	`str`
resource_id	`str`
properties	`str`
time	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag74cloud.azure.managedclusters.csi_azuredisk_controller

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
attrs	`str`
operation_name	`str`
category	`str`
resource_id	`str`
properties	`str`
time	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag75cloud.azure.managedclusters.csi_azurefile_controller

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
attrs	`str`
operation_name	`str`
category	`str`
resource_id	`str`
properties	`str`
time	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

76-80

cloud.azure.managedclusters.csi_snapshot_controller
cloud.azure.metrics.metricsBlobLog
cloud.azure.metrics.metricsCapacityBlob
cloud.azure.metrics.metricsLog
cloud.azure.metrics.metricsTableLog

tag76cloud.azure.managedclusters.csi_snapshot_controller

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
attrs	`str`
operation_name	`str`
category	`str`
resource_id	`str`
properties	`str`
time	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag77cloud.azure.metrics.metricsBlobLog

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
rawMessage	`str`	✓
version	`str`
reqStartTime	`str`
opType	`str`
reqStatus	`str`
httpStatusCode	`int4`
endLatency	`int8`
serverLatency	`int8`
authType	`str`
reqAccountName	`str`
ownerAccountName	`str`
serviceType	`str`
reqUrl	`str`
reqObjectKey	`str`
reqIdHeader	`str`
opCount	`int4`
reqIp	`ip4`
reqIpPort	`int4`
reqVerHeader	`str`
reqHeaderSize	`int8`
reqPacketSize	`int8`
resHeaderSize	`int8`
resPacketSize	`int8`
reqContentLength	`int8`
reqMD5	`str`
serverMD5	`str`
etagId	`str`
lastModified	`str`
conditionsUsed	`str`
userAgent	`str`
referrer	`str`
cliReqId	`str`
hostchain	`str`	✓
tag	`str`	✓

tag78cloud.azure.metrics.metricsCapacityBlob

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
rawMessage	`str`	✓
partitionKey	`str`
rowKey	`str`
timestamp	`str`
capacity	`int8`
containerCount	`int8`
objectCount	`int8`
hostchain	`str`	✓
tag	`str`	✓

tag80cloud.azure.metrics.metricsTableLog

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
rawMessage	`str`	✓
version	`str`
reqStartTime	`str`
opType	`str`
reqStatus	`str`
httpStatusCode	`int4`
endLatency	`int8`
serverLatency	`int8`
authType	`str`
reqAccountName	`str`
ownerAccountName	`str`
serviceType	`str`
reqUrl	`str`
reqObjectKey	`str`
reqIdHeader	`str`
opCount	`int4`
reqIp	`ip4`
reqIpPort	`int4`
reqVerHeader	`str`
reqHeaderSize	`int8`
reqPacketSize	`int8`
resHeaderSize	`int8`
resPacketSize	`int8`
reqContentLength	`int8`
reqMD5	`str`
serverMD5	`str`
etagId	`str`
lastModified	`str`
conditionsUsed	`str`
userAgent	`str`
referrer	`str`
cliReqId	`str`
hostchain	`str`	✓
tag	`str`	✓