Whether sent to Azure storage or Event Hub, the Activity log data share the same schema. One of the fields in the logs is correlationId. Events that share a correlationId belong to the same uber action. Can someone share an example of what is an uber action here?
Activity Logs tracks management plane operations going through Azure Resource Manager (ARM). If you deploy a template, all the records generated from the template execution will share the same CorrelationId.