来自事件中心的系统日志数据未显示在Azure data Explorer中

我的linux虚拟机安装了linux Azure Diagnostics扩展，并配置为将系统日志消息推送到事件中心

我可以在事件中心进程数据刀片上查看我的系统日志消息。现在我正试图将这些日志发送到Azure Data Explorer，为此我遵循了以下步骤

在ADX中创建集群

创建了用于存储系统日志消息的数据库（

Syslog

）和表（

SyslogTable

）

创建了Syslog表的JSON映射，映射事件中心数据包含的字段

创建了将事件中心连接到ADX表的数据摄取连接

一切正常，没有出现任何错误，因为

。显示摄取失败

没有显示任何错误，但我无法在ADX表中看到任何数据

下面是示例配置

以Json格式从事件中心查看的示例数据

{
    "time": "2020-05-18T15:54:01.0000000Z",
    "resourceId": "/subscriptions/xxxxx/resourceGroups/xxxx/providers/Microsoft.Compute/virtualMachines/vmname",
    "properties": {
      "ident": "systemd",
      "Ignore": "syslog",
      "Facility": "daemon",
      "Severity": "info",
      "EventTime": "2020-05-18T15:54:01.0000000",
      "SendingHost": "localhost",
      "Msg": "Removed slice User Slice of root.",
      "hostname": "vmname",
      "FluentdIngestTimestamp": "2020-05-18T15:54:01.0000000Z"
    },
    "category": "daemon",
    "level": "info",
    "operationName": "LinuxSyslogEvent",
    "EventProcessedUtcTime": "2020-05-19T07:39:48.5220591Z",
    "PartitionId": 0,
    "EventEnqueuedUtcTime": "2020-05-18T15:54:05.4390000Z"
  }

ADX表格模式

.create table SyslogTable (
eventTime: datetime,
resourceId: string,
properties: dynamic ,
category: string,
level: string,
operationName: string,
EventProcessedUtcTime: string,
PartitionId: int,
EventEnqueuedUtcTime: datetime
)

ADX系统日志表映射

.create table SyslogTable ingestion json mapping "SyslogMapping" 
'['
' {"column":"eventTime", "Properties": {"Path": "$.time"}},'
' {"column":"resourceId", "Properties": {"Path":"$.resourceId"}},'
' {"column":"properties", "Properties": {"Path":"$.properties"}},'
' {"column":"category", "Properties": {"Path":"$.category"}},'
' {"column":"level", "Properties": {"Path": "$.level"}},'
' {"column":"operationName", "Properties": {"Path": "$.operationName"}},'
' {"column":"EventProcessedUtcTime", "Properties": {"Path": "$.EventProcessedUtcTime"}},'
' {"column":"PartitionId", "Properties": {"Path": "$.PartitionId"}},'
' {"column":"EventEnqueuedUtcTime", "Properties": {"Path": "$.EventEnqueuedUtcTime"}}'
']'

数据连接设置

Table: SyslogTable
Column Mapping: SyslogMapping
Data Format: Multiline Json/Json # tried with both

---

那么，我在这里遗漏了什么呢？

考虑到表模式和负载模式，您的摄取映射似乎没有问题

例如，如果您运行此命令，您将看到数据被成功接收

.ingest inline into table SyslogTable with(format=multijson, ingestionMappingReference='SyslogMapping') <|
{
    "time": "2020-05-18T15:54:01.0000000Z",
    "resourceId": "/subscriptions/xxxxx/resourceGroups/xxxx/providers/Microsoft.Compute/virtualMachines/vmname",
    "properties": {
      "ident": "systemd",
      "Ignore": "syslog",
      "Facility": "daemon",
      "Severity": "info",
      "EventTime": "2020-05-18T15:54:01.0000000",
      "SendingHost": "localhost",
      "Msg": "Removed slice User Slice of root.",
      "hostname": "vmname",
      "FluentdIngestTimestamp": "2020-05-18T15:54:01.0000000Z"
    },
    "category": "daemon",
    "level": "info",
    "operationName": "LinuxSyslogEvent",
    "EventProcessedUtcTime": "2020-05-19T07:39:48.5220591Z",
    "PartitionId": 0,
    "EventEnqueuedUtcTime": "2020-05-18T15:54:05.4390000Z"
}

---

.ingest内嵌到表SyslogTable中，格式为（format=multijson，ingestionMappingReference='SyslogMapping'）数据未被推送到ADX表的问题是因为我在数据连接设置中定义了
$Default
消费者组，并且我已经在使用
$Default
消费者组从其他地方获取事件

因此，解决方案很简单，即为事件中心创建一个新的消费者组并创建新的数据连接。
是的，我正在与一些MS人员合作，一键摄取对我来说也很好，而且我能够使用标准python sdk实时接收来自EH的数据，这就证明了这肯定是被推到了呃。