Event Grid (UNMATCHED EVENT)

PRADEEP RAGUL S 0

Hey there,
I have configured a event grid subscription on KeyVault to a function app , Where I have selected the event to set
[ Microsoft.KeyVault.secretExpired ] , so when ever i have tried to create a secret with expiry within next 2 mins , it raise an event trigger on the topic level , but on the subscription metrics it shows Unmatched events.
I have attached the photo of the metrics as well , where you can see the published event -1 and umatched events-1 and no dropped events & no failed delivery events as well.
User's image

This is the selected event type for you reference.

User's image

Can Anyone look into this , would be greatly helpful.

RevelinoB 2,775 Reputation points

2024-03-09T06:05:56.1866667+00:00
Hi Pradeep,

The screenshots you've provided help to give context to the issue. The first screenshot shows that you have set up an event grid subscription on KeyVault with the specific event type [ Microsoft.KeyVault.secretExpired ] selected. The second screenshot displays the metrics from this event grid subscription, where it indicates that there has been one published event and one unmatched event, with no dropped or delivery failed events.

The fact that the event is published but shows as unmatched suggests that the event is being sent to the event grid topic but does not match any of the event subscription criteria. This can happen for several reasons:

Filtering Issue: If there is any filtering set up on the subscription that specifies criteria that the event does not meet, it will be marked as unmatched. This could be a subject filter or an advanced filter that isn't aligned with the events being published.

Event Schema Mismatch: If the event schema expected by the function app doesn't match the schema of the event being published, the event grid may not recognize it as a match.

Event Type Selection: It's also possible that the event type [ Microsoft.KeyVault.secretExpired ] may not be the correct event type or there may be an issue with how the event is being handled. It could be beneficial to verify that the event type exactly matches what Key Vault emits when a secret expires.

Subject Filter Configuration: The 'Enable subject filtering' checkbox is unchecked. If your function app expects a certain subject format and the event does not match this format, it might result in unmatched events. Ensure that if the subject filtering is necessary, it is correctly configured.

Time Zone/Time Setting Issue: Your function might be missing the event if there's a discrepancy in time zones or time settings between when the event is published and when it is expected.

Function App Configuration: There could be a misconfiguration in the function app that's causing it not to accept or properly process the event.

Here are some steps you can take to troubleshoot this issue:

Check the Event Subscription Filters: Make sure there are no subject or advanced filters that are unintentionally filtering out this event.

Inspect the Event Schema: Look at the details of the published event to ensure it matches what the function app is expecting.

Review Function App Logs: Check the logs of the function app to see if it's receiving and processing the events as expected.

Event Grid Schema: Double-check that the schema of the event grid matches with what is expected by the event grid topic and the subscription.

Test with a Broader Subscription: Temporarily remove filters to test if the event matches without them. If it matches, then add back filters one by one to identify which one is causing the issue.

Time Synchronization: Ensure that the time settings are synchronized and that there's no mismatch that could be causing the event to be published outside of the expected window.

I hope this helps, if you have any questions please let me know.