Not able to see messages spike in event hub while sending logs from log analytics workspace data export rule to event hub

Question

Hi Team, I am sending logs from log analytics workspace data export rule to event hub. I am able to see spike of requests in event hub but not able to see spike of messages in event hub. I also confirm that table is in supportable by data export rule. Can you please let me know why I am not getting messages in event hub? Thanks

Answer 1

Hi @Akash Bankar

Thank you for posting your query!

As I understand that you are seeing a spike in requests in Event Hub but not in messages when sending logs from Log Analytics Workspace via a Data Export Rule. Here are a few possible reasons and troubleshooting steps:

Confirm Data Export Rule Configuration - Ensure that the Log Analytics Data Export Rule is correctly configured with the right Event Hub Namespace and Event Hub Name. Verify that the table being exported is actively receiving logs by running a Kusto query in Log Analytics:

{YourTableName}
| where TimeGenerated > ago(1h)

Check Event Hub Metrics - Go to Event Hub Namespace > Metrics and review the following:

• Incoming Messages – Should increase as logs arrive.
• Incoming Requests – High requests but low messages could indicate an issue.
• Throttled Requests – If high, Event Hub might be rejecting messages due to quota limits.

Validate Permissions - The Log Analytics Workspace's managed identity must have the Azure Event Hubs Data Sender role. Navigate to Event Hub Namespace > Access Control (IAM) > Role Assignments and ensure the correct identity has the necessary permissions.

Check for Message Size or Batching Issues - Event Hub enforces a 1 MB per event and 256 KB per batch limit. Logs exceeding these limits might fail to be ingested. Check Incoming Messages vs. Incoming Requests in metrics—if requests are increasing but messages aren't, size limitations might be the issue. Try adjusting batch size or reducing log volume.

Look for Latency or Failures - Logs might be delayed in reaching Event Hub. Wait 5-10 minutes and check again. Go to Log Analytics > Data Export to check for failures in export delivery. Enable Diagnostic Logs for both Log Analytics and Event Hub to capture potential errors.

Verify Event Hub Consumer Configuration - If an active Event Hub consumer is immediately processing and deleting messages, they may not be visible in metrics. Run the following PowerShell command to check message backlog:

Get-AzEventHubConsumerGroup -ResourceGroupName "<ResourceGroup>" -NamespaceName "<EventHubNamespace>" -EventHubName "<EventHubName>"

For additional information, please refer the following documents:

• Azure Event Hubs quotas and limits
• Standard columns in Azure Monitor Logs
• Get-AzEventHubConsumerGroup

I hope this information helps. Please do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.