Initialize the Event Hub Beat using MSI

Before you initialize the Beat, you must have the Open Collector installed. If you do not already have it installed, follow the instructions in the Open Collector Installation and User Guide, and then return to this topic.

Initialize the Beat via the Web Console (Recommended)

Ensure that the Open Collector Connection to the SIEM (WebUI) setup has been completed.
Ensure that the System Monitor Agent to which you intend to send these logs has been Configured for JSON Parsing.

Use either the Enable JSON Parsing on System Monitor Agents or the Enable JSON Parsing for an Existing System Monitor Agent sections at the above link to configure the System Monitor Agent for JSON Parsing.

Follow the steps outlined in Add a Beat in the Web Console to create the Beat via the Web UI.

Initialize the Beat via Command Line (Legacy)

In the Open Collector, run the following command:
```
./lrctl eventhubbeat start
```
Use the Up and Down Arrow keys to select New eventhubbeat instance from the list, and then press Enter.
Enter the unique identifier for this eventhubbeat instance, and then press Enter.
At the prompt to deploy the Event Hub Beat service on Azure VM, type Y.

If you do not want to deploy the Event Hub Beat service on Azure VM, follow the steps in Initialize the Event Hubs Beat Using Connection Strings.
Enter the following information:
1. Enter the Subscription ID.
  
  Event Hub Connection Strings, Storage Connection Strings, and Subscription IDs are stored in encrypted format in the configuration file
2. Enter the Resource Group Name.
3. Enter the Storage Name.
4. Enter Event Hub Namespace Name.
5. Enter Event Hub Instance Name.
6. Enter Storage Container Name.
  
  You can enter more than one event hub namespace, event hub instance name, and storage container name at a time.
7. When you are finished, type c and press Enter.
Enter the hostname or IP address of the System Monitor Agent that has been Configured for JSON Parsing, and then press Enter.

Enter the port on which the System Monitor Agent is configured to listen for JSON data (the default is 5044), and then press Enter.
The Eventhubbeat service started message appears.
Check the status of the service to confirm that it’s running:
```
./lrctl eventhubbeat status
```
(Optional) Edit the eventhubbeat configuration to update the values set above if needed. Ensure that you have all the needed information for each step available as you will need to re-enter it:
```
./lrctl eventhubbeat config edit
```

Default Config Values for EventHubBeat:

S. No.	Field Name	Default Value
1.	period	1s
2.	HeartbeatInterval	5m0s
3.	HeartbeatDisabled	false
4.	StorageConnectionString	User Provided
5.	ConnectionString	User Provided
6.	ConsumerGroup	User Provided
7.	Time Period	5s
8.	Azure Flag	false
9.	SubscriptionID	User Provided
10.	ResourceGroupName	User Provided
11.	EventHubDetails	User Provided
12.	StorageAccountNameMSI	User Provided