Filebeat 7.8 Azure Module - unsupported protocol scheme error.

[kevinserafin]

• Version: 7.8
• Operating System: Ubuntu 18.04
• Discuss Forum URL: https://discuss.elastic.co/t/filebeat-7-8-azure-module-issue/237727/3
• Steps to Reproduce: Fresh install, configure filebeat to local elasticsearch node and enable Azure module. Add the following to azure module:

  # All logs
  activitylogs:
    enabled: true
    var:
      eventhub: "azure-control"
      consumer_group: "$Default"
      connection_string: "Endpoint=sb://myeventhub.servicebus.windows.net/;SharedAccessKeyName=filebeat;SharedAccessKey=mySASkey"
      storage_account: "mystorageaccount"
      storage_account_key: "mystorageaccountkey"

  auditlogs:
    enabled: true
    var:
      eventhub: "azure-adaudit"
      consumer_group: "$Default"
      connection_string: "Endpoint=sb://myeventhub.servicebus.windows.net/;SharedAccessKeyName=filebeat;SharedAccessKey=mySASkey"
      storage_account: "mystorageaccount"
      storage_account_key: "mystorageaccountkey"
  signinlogs:
    enabled: true
    var:
      eventhub: "azure-signin"
      consumer_group: "$Default"
      connection_string: "Endpoint=sb://myeventhub.servicebus.windows.net/;SharedAccessKeyName=filebeat;SharedAccessKey=mySASkey"
      storage_account: "mystorageaccount"
      storage_account_key: "mystorageaccountkey"

After starting with debug logging the following error presents itself. Same configuration on 7.7 works fine.

2020-06-18T23:19:14.508-0500	INFO	cfgfile/reload.go:224	Loading of config files completed.
2020-06-18T23:19:14.508-0500	INFO	[azure-eventhub input]	azureeventhub/input.go:107	azure-eventhub input worker has started.	{"connection string": "Endpoint=sb://eventhub.servicebus.windows.net/;SharedAccessKeyName=azurefilebeat;SharedAccessKey=saskey..."}
2020-06-18T23:19:14.509-0500	ERROR	[azure-eventhub input]	azureeventhub/input.go:113	Get %3Cno%20value%3E/metadata/endpoints?api-version=1.0: unsupported protocol scheme ""	{"connection string": "Endpoint=sb://eventhub.servicebus.windows.net/;SharedAccessKeyName=azurefilebeat;SharedAccessKey=saskey..."}
2020-06-18T23:19:14.509-0500	INFO	[azure-eventhub input]	azureeventhub/input.go:114	azure-eventhub input worker has stopped.	{"connection string": "Endpoint=sb://eventhub.servicebus.windows.net/;SharedAccessKeyName=azurefilebeat;SharedAccessKey=saskey..."}

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[narph]

@kevinserafin , you might be hitting this #18890 where due to some internal changes no azure environment is selected. This has already been fixed but did not made it in 7.8.0 unfortunately.
Can you add the following setting:

resource_manager_endpoint:  ""

under each var block
this makes sure the default azure env (public) is selected.
Will make sure future 7.8 versions will contain a fix.

[kevinserafin]

That did it, thanks!