Experiencing the same issue, unable to forward the application logs directly to event hub. The work around is to create a rule to forward the logs to the storage account and create a rule to pick it up from storage blob and stream it real time to event hub. Creating a job to forward logs to storage account: https://docs.microsoft.com/en-us/azure/connectors/connectors-create-api-azure-event-hubs#add-action Stream logs from storage account to event hub: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub

You can enable diagonistic logs and send those to eventhub

https://docs.microsoft.com/en-us/azure/aks/view-master-logs#enable-diagnostics-logs