Skip to content

Commit 3708317

Browse files
ttorblettorble
authored
Merge pull request #222704 from guywi-ms/logs-manage-schema-api
Azure Monitor Logs schema management API
2 parents 5888df7 + 97b567b commit 3708317

File tree

6 files changed

+359
-180
lines changed

6 files changed

+359
-180
lines changed

‎articles/azure-monitor/logs/basic-logs-configure.md

Lines changed: 53 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -17,63 +17,63 @@ Azure Monitor Logs offers two log data plans that let you reduce log ingestion a
1717

1818
This article describes Azure Monitor's log data plans and explains how to configure the log data plan of the tables in your Log Analytics workspace.
1919

20-
> [!IMPORTANT]
21-
> You can switch a table's plan once a week.<br/> The Basic Logs feature isn't available for workspaces in [legacy pricing tiers](cost-logs.md#legacy-pricing-tiers).
22-
2320
## Compare the Basic and Analytics log data plans
2421

25-
The following table summarizes the two plans.
22+
The following table summarizes the Basic and Analytics log data plans.
2623

2724
| Category | Analytics | Basic |
2825
|:---|:---|:---|
29-
| Ingestion | Cost for ingestion. | Reduced cost for ingestion. |
30-
| Log queries | No extra cost. Full query capabilities. | Extra cost.<br/>[Subset of query capabilities](basic-logs-query.md#limitations). |
31-
| Retention | Configure retention from 30 days to 730 days. | Retention fixed at eight days. |
26+
| Ingestion | Regular ingestion cost. | Reduced ingestion cost. |
27+
| Log queries | Full query capabilities<br/>No extra cost. | [Basic query capabilities](basic-logs-query.md#limitations).<br/>Pay-per-use.|
28+
| Retention | [Configure retention from 30 days to two years](data-retention-archive.md). | Retention fixed at eight days.<br/>When you change an existing table's plan to Basic logs, [Azure archives data](data-retention-archive.md) that's more than eight days old but still within the table's original retention period. |
3229
| Alerts | Supported. | Not supported. |
3330

3431
> [!NOTE]
3532
> The Basic log data plan isn't available for workspaces in [legacy pricing tiers](cost-logs.md#legacy-pricing-tiers).
3633
37-
## When should I use Basic Logs?
38-
The decision whether to configure a table for Basic Logs is based on the following criteria:
34+
## When should I use Basic logs?
3935

40-
- The table currently [supports Basic Logs](#which-tables-support-basic-logs).
41-
- You don't require more than eight days of data retention for the table.
42-
- You only require basic queries of the data using a limited version of the query language.
43-
- The cost savings for data ingestion over a month exceed the expected cost for any expected queries
44-
45-
## Which tables support Basic Logs?
46-
47-
By default, all tables in your Log Analytics workspace are Analytics tables, and they're available for query and alerts. You can currently configure the following tables for Basic Logs:
48-
49-
| Table | Details|
50-
|:---|:---|
51-
| Custom tables | All custom tables created with or migrated to the [data collection rule (DCR)-based logs ingestion API.](logs-ingestion-api-overview.md) |
52-
| [ACSCallAutomationIncomingOperations](/azure/azure-monitor/reference/tables/ACSCallAutomationIncomingOperations) | Communication Services incoming requests Calls. |
53-
| [ACSCallRecordingSummary](/azure/azure-monitor/reference/tables/acscallrecordingsummary) | Communication Services recording summary logs. |
54-
| [ACSRoomsIncomingOperations](/azure/azure-monitor/reference/tables/acsroomsincomingoperations) | Communication Services Rooms incoming requests operations. |
55-
| [AHDSMedTechDiagnosticLogs](/azure/azure-monitor/reference/tables/AHDSMedTechDiagnosticLogs) | Health Data Services operational logs. |
56-
| [AppTraces](/azure/azure-monitor/reference/tables/apptraces) | Application Insights Freeform traces. |
57-
| [AMSLiveEventOperations](/azure/azure-monitor/reference/tables/AMSLiveEventOperations) | Azure Media Services encoder connects, disconnects, or discontinues. |
58-
| [AMSKeyDeliveryRequests](/azure/azure-monitor/reference/tables/AMSKeyDeliveryRequests) | Azure Media Services HTTP request details for key, or license acquisition. |
59-
| [AMSMediaAccountHealth](/azure/azure-monitor/reference/tables/AMSMediaAccountHealth) | Azure Media Services account health status. |
60-
| [AMSStreamingEndpointRequests](/azure/azure-monitor/reference/tables/AMSStreamingEndpointRequests) | Azure Media Services information about requests to streaming endpoints. |
61-
| [ContainerAppConsoleLogs](/azure/azure-monitor/reference/tables/containerappconsoleLogs) | Azure Container Apps logs, generated within a Container Apps environment. |
62-
| [ContainerLogV2](/azure/azure-monitor/reference/tables/containerlogv2) | Used in [Container insights](../containers/container-insights-overview.md) and includes verbose text-based log records. |
63-
| [DevCenterDiagnosticLogs](/azure/azure-monitor/reference/tables/DevCenterDiagnosticLogs) | Dev Center resources data plane audit logs. For example, dev boxes and environment stop, start, delete. |
64-
| [StorageBlobLogs](/azure/azure-monitor/reference/tables/StorageBlobLogs) | Azure Storage blob service logs. |
65-
| [StorageFileLogs](/azure/azure-monitor/reference/tables/StorageFileLogs) | Azure Storage file service logs. |
66-
| [StorageQueueLogs](/azure/azure-monitor/reference/tables/StorageQueueLogs) | Azure Storage queue service logs. |
67-
| [StorageTableLogs](/azure/azure-monitor/reference/tables/StorageTableLogs) | Azure Storage table service logs. |
36+
By default, all tables in your Log Analytics workspace are Analytics tables, and they're available for query and alerts.
37+
38+
Configure a table for Basic logs if:
6839

40+
- You don't require more than eight days of data retention for the table.
41+
- You only require basic queries of the data using a [limited version of the query language](basic-logs-query.md#limitations).
42+
- The cost savings for data ingestion exceed the expected cost for any expected queries.
43+
- The table supports Basic logs.
44+
45+
These tables currently support Basic logs:
46+
47+
| Table | Details|
48+
|:---|:---|
49+
| Custom tables | All custom tables created with or migrated to the [data collection rule (DCR)-based logs ingestion API.](logs-ingestion-api-overview.md) |
50+
| [ACSCallAutomationIncomingOperations](/azure/azure-monitor/reference/tables/ACSCallAutomationIncomingOperations) | Communication Services incoming requests Calls. |
51+
| [ACSCallRecordingSummary](/azure/azure-monitor/reference/tables/acscallrecordingsummary) | Communication Services recording summary logs. |
52+
| [ACSRoomsIncomingOperations](/azure/azure-monitor/reference/tables/acsroomsincomingoperations) | Communication Services Rooms incoming requests operations. |
53+
| [AHDSMedTechDiagnosticLogs](/azure/azure-monitor/reference/tables/AHDSMedTechDiagnosticLogs) | Health Data Services operational logs. |
54+
| [AppTraces](/azure/azure-monitor/reference/tables/apptraces) | Application Insights Freeform traces. |
55+
| [AMSLiveEventOperations](/azure/azure-monitor/reference/tables/AMSLiveEventOperations) | Azure Media Services encoder connects, disconnects, or discontinues. |
56+
| [AMSKeyDeliveryRequests](/azure/azure-monitor/reference/tables/AMSKeyDeliveryRequests) | Azure Media Services HTTP request details for key, or license acquisition. |
57+
| [AMSMediaAccountHealth](/azure/azure-monitor/reference/tables/AMSMediaAccountHealth) | Azure Media Services account health status. |
58+
| [AMSStreamingEndpointRequests](/azure/azure-monitor/reference/tables/AMSStreamingEndpointRequests) | Azure Media Services information about requests to streaming endpoints. |
59+
| [ContainerAppConsoleLogs](/azure/azure-monitor/reference/tables/containerappconsoleLogs) | Azure Container Apps logs, generated within a Container Apps environment. |
60+
| [ContainerLogV2](/azure/azure-monitor/reference/tables/containerlogv2) | Used in [Container insights](../containers/container-insights-overview.md) and includes verbose text-based log records. |
61+
| [DevCenterDiagnosticLogs](/azure/azure-monitor/reference/tables/DevCenterDiagnosticLogs) | Dev Center resources data plane audit logs. For example, dev boxes and environment stop, start, delete. |
62+
| [StorageBlobLogs](/azure/azure-monitor/reference/tables/StorageBlobLogs) | Azure Storage blob service logs. |
63+
| [StorageFileLogs](/azure/azure-monitor/reference/tables/StorageFileLogs) | Azure Storage file service logs. |
64+
| [StorageQueueLogs](/azure/azure-monitor/reference/tables/StorageQueueLogs) | Azure Storage queue service logs. |
65+
| [StorageTableLogs](/azure/azure-monitor/reference/tables/StorageTableLogs) | Azure Storage table service logs. |
66+
6967
> [!NOTE]
70-
> Tables created with the [Data Collector API](data-collector-api.md) don't support Basic Logs.
68+
> Tables created with the [Data Collector API](data-collector-api.md) don't support Basic logs.
7169
7270
## Set a table's log data plan
7371

72+
You can switch a table's plan once a week.
73+
7474
# [Portal](#tab/portal-1)
7575

76-
To configure a table for Basic Logs or Analytics Logs in the Azure portal:
76+
To configure a table for Basic logs or Analytics logs in the Azure portal:
7777

7878
1. From the **Log Analytics workspaces** menu, select **Tables**.
7979

@@ -85,15 +85,15 @@ To configure a table for Basic Logs or Analytics Logs in the Azure portal:
8585

8686
1. From the **Table plan** dropdown on the table configuration screen, select **Basic** or **Analytics**.
8787

88-
The **Table plan** dropdown is enabled only for [tables that support Basic Logs](#which-tables-support-basic-logs).
88+
The **Table plan** dropdown is enabled only for [tables that support Basic logs](#when-should-i-use-basic-logs).
8989

9090
:::image type="content" source="media/basic-logs-configure/log-analytics-configure-table-plan.png" lightbox="media/basic-logs-configure/log-analytics-configure-table-plan.png" alt-text="Screenshot that shows the Table plan dropdown on the table configuration screen.":::
9191

9292
1. Select **Save**.
9393

9494
# [API](#tab/api-1)
9595

96-
To configure a table for Basic Logs or Analytics Logs, call the **Tables - Update** API:
96+
To configure a table for Basic logs or Analytics logs, call the [Tables - Update API](/rest/api/loganalytics/tables/create-or-update):
9797

9898
```http
9999
PATCH https://management.azure.com/subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/tables/<tableName>?api-version=2021-12-01-preview
@@ -110,17 +110,17 @@ PATCH https://management.azure.com/subscriptions/<subscriptionId>/resourcegroups
110110

111111
**Example**
112112

113-
This example configures the `ContainerLogV2` table for Basic Logs.
113+
This example configures the `ContainerLogV2` table for Basic logs.
114114

115-
Container insights uses `ContainerLog` by default. To switch to using `ContainerLogV2` for Container insights, [enable the ContainerLogV2 schema](../containers/container-insights-logging-v2.md) before you convert the table to Basic Logs.
115+
Container insights uses `ContainerLog` by default. To switch to using `ContainerLogV2` for Container insights, [enable the ContainerLogV2 schema](../containers/container-insights-logging-v2.md) before you convert the table to Basic logs.
116116

117117
**Sample request**
118118

119119
```http
120120
PATCH https://management.azure.com/subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace/tables/ContainerLogV2?api-version=2021-12-01-preview
121121
```
122122

123-
Use this request body to change to Basic Logs:
123+
Use this request body to change to Basic logs:
124124

125125
```http
126126
{
@@ -142,7 +142,7 @@ Use this request body to change to Analytics Logs:
142142

143143
**Sample response**
144144

145-
This sample is the response for a table changed to Basic Logs:
145+
This sample is the response for a table changed to Basic logs:
146146

147147
Status code: 200
148148

@@ -163,11 +163,11 @@ Status code: 200
163163

164164
# [CLI](#tab/cli-1)
165165

166-
To configure a table for Basic Logs or Analytics Logs, run the [az monitor log-analytics workspace table update](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-update) command and set the `--plan` parameter to `Basic` or `Analytics`.
166+
To configure a table for Basic logs or Analytics logs, run the [az monitor log-analytics workspace table update](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-update) command and set the `--plan` parameter to `Basic` or `Analytics`.
167167

168168
For example:
169169

170-
- To set Basic Logs:
170+
- To set Basic logs:
171171

172172
```azurecli
173173
az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name ContainerLogV2 --plan Basic
@@ -179,90 +179,18 @@ For example:
179179
az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name ContainerLogV2 --plan Analytics
180180
```
181181
182-
---
183-
184-
## View a table's log data plan
185-
186-
# [Portal](#tab/portal-2)
187-
188-
To check table configuration in the Azure portal, you can open the table configuration screen, as described in [Set table configuration](#set-a-tables-log-data-plan).
189-
190-
Alternatively:
191-
192-
1. From the **Azure Monitor** menu, select **Logs** and select your workspace for the [scope](scope.md). See the [Log Analytics tutorial](log-analytics-tutorial.md#view-table-information) for a walkthrough.
193-
1. Open the **Tables** tab, which lists all tables in the workspace.
194-
195-
Basic Logs tables have a unique icon:
196-
197-
:::image type="content" source="media/basic-logs-configure/table-icon.png" alt-text="Screenshot that shows the Basic Logs table icon in the table list." lightbox="media/basic-logs-configure/table-icon.png":::
198-
199-
You can also hover over a table name for the table information view, which indicates whether the table is configured as Basic Logs:
200-
201-
:::image type="content" source="media/basic-logs-configure/table-info.png" alt-text="Screenshot that shows the Basic Logs table indicator in the table details." lightbox="media/basic-logs-configure/table-info.png":::
202-
203-
# [API](#tab/api-2)
204-
205-
To check the configuration of a table, call the **Tables - Get** API:
206-
207-
```http
208-
GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2021-12-01-preview
209-
```
210-
211-
**Response body**
212-
213-
|Name | Type | Description |
214-
| --- | --- | --- |
215-
|properties.plan | string | The table plan. Either `Analytics` or `Basic`. |
216-
|properties.retentionInDays | integer | The table's data retention in days. In `Basic Logs`, the value is eight days, fixed. In `Analytics Logs`, the value is between 7 and 730 days.|
217-
|properties.totalRetentionInDays | integer | The table's data retention that also includes the archive period.|
218-
|properties.archiveRetentionInDays|integer|The table's archive period (read-only, calculated).|
219-
|properties.lastPlanModifiedDate|String|Last time when the plan was set for this table. Null if no change was ever done from the default settings (read-only).
220-
221-
**Sample request**
182+
# [PowerShell](#tab/azure-powershell)
222183
223-
```http
224-
GET https://management.azure.com/subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace/tables/ContainerLogV2?api-version=2021-12-01-preview
225-
```
184+
To configure a table's log data plan, use the [Update-AzOperationalInsightsTable](/powershell/module/az.operationalinsights/Update-AzOperationalInsightsTable) cmdlet:
226185
227-
**Sample response**
228-
229-
Status code: 200
230-
```http
231-
{
232-
"properties": {
233-
"retentionInDays": 8,
234-
"totalRetentionInDays": 8,
235-
"archiveRetentionInDays": 0,
236-
"plan": "Basic",
237-
"lastPlanModifiedDate": "2022-01-01T14:34:04.37",
238-
"schema": {...},
239-
"provisioningState": "Succeeded"
240-
},
241-
"id": "subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace",
242-
"name": "ContainerLogV2"
243-
}
244-
```
245-
246-
# [CLI](#tab/cli-2)
247-
248-
To check the configuration of a table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
249-
250-
For example:
251-
252-
```azurecli
253-
az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name Syslog --output table
186+
```powershell
187+
Update-AzOperationalInsightsTable -ResourceGroupName RG-NAME -WorkspaceName WORKSPACE-NAME -Plan Basic|Analytics
254188
```
255189

256190
---
257191

258-
## Retain and archive Basic Logs
259-
260-
Analytics tables retain data based on a [retention and archive policy](data-retention-archive.md) you set.
261-
262-
Basic Logs tables retain data for eight days. When you change an existing table's plan to Basic Logs, Azure archives data that's more than eight days old but still within the table's original retention period.
263-
264192
## Next steps
265193

266-
- [Query data in Basic Logs](basic-logs-query.md)
194+
- [View table properties](../logs/manage-logs-tables.md#view-table-properties)
267195
- [Set retention and archive policies](../logs/data-retention-archive.md)
268-
196+
- [Query data in Basic logs](basic-logs-query.md)

0 commit comments

Comments
 (0)