rsyslog gains native Azure Monitor Logs Ingestion support
Cloud logging environments are rarely simple. Many organizations run mixed estates where on-prem systems, private infrastructure, and cloud services all need to feed into a central observability workflow. That is exactly where rsyslog is supposed to help: reliable, flexible log transport and processing without forcing a one-size-fits-all architecture.
We have now taken another step in that direction.
With the merge of PR #6615 on March 18, 2026, rsyslog now includes a new output module, omazuredce, for sending events directly to Azure Monitor Logs Ingestion. The merged change includes the module itself, documentation, configuration parameters, build integration, and tests.
Why this matters
For users working with Microsoft Azure, this adds a more direct integration path from rsyslog into Azure-based monitoring and analysis workflows. Instead of building custom forwarding glue around generic HTTP output or separate ingestion tooling, rsyslog can now integrate more naturally with Azure Monitor’s ingestion model.
That is useful in several practical scenarios:
- hybrid environments that collect logs locally but analyze centrally in Azure
- staged migrations where existing rsyslog deployments need cloud integration
- enterprise environments that want deterministic local processing before forwarding data onward
- architectures that need one logging engine across multiple destinations
So this is not just another module. It is a concrete improvement in how rsyslog fits into modern real-world deployments.
What is included
The new module adds support for Azure Monitor Logs Ingestion via omazuredce. According to the merged PR, the work includes core module support, batching, authentication handling, configuration documentation, build system updates, and tests.
That matters because users do not just need features in theory. They need features that are packaged, documented, and realistic to deploy.
Thanks and credit
A sincere thank you goes to Jns234 for contributing this work. The PR was opened by Jns234 and brought in the new omazuredce module together with the surrounding documentation and integration work that makes the feature actually usable. Contributions like this help rsyslog stay practical, current, and relevant across changing deployment environments.
The bigger picture
rsyslog has always been about practical interoperability. New destinations and deployment paths matter when they make the engine more useful in production. Azure is one of those environments.
This addition also fits a broader direction: making rsyslog easier to use as the backbone of modern logging pipelines, whether the target is self-hosted infrastructure, established observability stacks, or cloud platforms.
We will continue to refine our path forward.
Learn more
You can review the merged work here: