I use azure log workspace to hold logs that come from iot hub, such as device disconnect event. I can query on AzureDiagnostics table and active alert rule then send to function
