You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-data-export.md
+15-15Lines changed: 15 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Data in Log Analytics is available for the retention period defined in your work
21
21
22
22
After you've configured data export rules in a Log Analytics workspace, new data for tables in rules is exported from the Azure Monitor pipeline to your storage account or event hubs as it arrives.
23
23
24
-
[](media/logs-data-export/data-export-overview.png#lightbox)
24
+
[](media/logs-data-export/data-export-overview.png#lightbox)
25
25
26
26
Data is exported without a filter. For example, when you configure a data export rule for a *SecurityEvent* table, all data sent to the *SecurityEvent* table is exported starting from the configuration time.
27
27
@@ -70,7 +70,7 @@ Blobs are stored in 5-minute folders in the following path structure: *Workspace
70
70
71
71
The format of blobs in a storage account is in [JSON lines](../essentials/resource-logs-blob-format.md), where each record is delimited by a new line, with no outer records array and no commas between JSON records.
72
72
73
-
[](media/logs-data-export/storage-data-expand.png#lightbox)
73
+
[](media/logs-data-export/storage-data-expand.png#lightbox)
If you've configured your storage account to allow access from selected networks, you need to add an exception to allow Azure Monitor to write to the account. From **Firewalls and virtual networks** for your storage account, select **Allow Azure services on the trusted services list to access this storage account**.
113
113
114
-
[](media/logs-data-export/storage-account-network.png#lightbox)
114
+
[](media/logs-data-export/storage-account-network.png#lightbox)
115
115
116
116
### Monitor destinations
117
117
@@ -161,7 +161,7 @@ A data export rule defines the destination and tables for which data is exported
161
161
162
162
1. On the **Log Analytics workspace** menu in the Azure portal, select **Data Export** under the **Settings** section. Select **New export rule** at the top of the pane.
163
163
164
-
[](media/logs-data-export/export-create-1.png#lightbox)
164
+
[](media/logs-data-export/export-create-1.png#lightbox)
165
165
166
166
1. Follow the steps, and then select **Create**.
167
167
@@ -462,7 +462,7 @@ Use the following command to create a data export rule to a specific event hub b
462
462
463
463
1. On the **Log Analytics workspace** menu in the Azure portal, select **Data Export** under the **Settings** section.
464
464
465
-
[](media/logs-data-export/export-view-1.png#lightbox)
465
+
[](media/logs-data-export/export-view-1.png#lightbox)
466
466
467
467
1. Select a rule for a configuration view.
468
468
@@ -504,7 +504,7 @@ The template option doesn't apply.
504
504
505
505
You can disable export rules to stop the export for a certain period, such as when testing is being held. On the **Log Analytics workspace** menu in the Azure portal, select **Data Export** under the **Settings** section. Select the **Status** toggle to disable or enable the export rule.
506
506
507
-
[](media/logs-data-export/export-disable.png#lightbox)
507
+
[](media/logs-data-export/export-disable.png#lightbox)
508
508
509
509
# [PowerShell](#tab/powershell)
510
510
@@ -557,7 +557,7 @@ You can disable export rules to stop export when testing is performed and you do
557
557
558
558
On the **Log Analytics workspace** menu in the Azure portal, select **Data Export** under the **Settings** section. Select the ellipsis to the right of the rule and select **Delete**.
559
559
560
-
[](media/logs-data-export/export-delete.png#lightbox)
560
+
[](media/logs-data-export/export-delete.png#lightbox)
561
561
562
562
# [PowerShell](#tab/powershell)
563
563
@@ -595,7 +595,7 @@ The template option doesn't apply.
595
595
596
596
On the **Log Analytics workspace** menu in the Azure portal, select **Data Export** under the **Settings** section to view all export rules in the workspace.
597
597
598
-
[](media/logs-data-export/export-view.png#lightbox)
598
+
[](media/logs-data-export/export-view.png#lightbox)
599
599
600
600
# [PowerShell](#tab/powershell)
601
601
@@ -781,7 +781,7 @@ All data from the table will be exported unless limitations are specified. This
781
781
| CommonSecurityLog ||
782
782
| ComputerGroup ||
783
783
| ConfidentialWatchlist ||
784
-
| ConfigurationData | Partial support. Some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
784
+
| ConfigurationData | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
785
785
| ContainerAppConsoleLogs ||
786
786
| ContainerAppSystemLogs ||
787
787
| ContainerImageInventory ||
@@ -857,7 +857,7 @@ All data from the table will be exported unless limitations are specified. This
857
857
| IdentityDirectoryEvents ||
858
858
| IdentityLogonEvents ||
859
859
| IdentityQueryEvents ||
860
-
| InsightsMetrics | Partial support. Some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
860
+
| InsightsMetrics | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
861
861
| IntuneAuditLogs ||
862
862
| IntuneDevices ||
863
863
| IntuneOperationalLogs ||
@@ -887,8 +887,8 @@ All data from the table will be exported unless limitations are specified. This
887
887
| OfficeActivity ||
888
888
| OLPSupplyChainEntityOperations ||
889
889
| OLPSupplyChainEvents ||
890
-
| Operation | Partial support. Some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
891
-
| Perf | Partial support. Only windows perf data is currently supported. The Linux perf data is missing in export currently. |
890
+
| Operation | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
891
+
| Perf | Partial support. Only Windows perf data is currently supported. Currently, the Linux perf data is missing in export. |
892
892
| PFTitleAuditLogs ||
893
893
| PowerBIActivity ||
894
894
| PowerBIAuditTenant ||
@@ -946,7 +946,7 @@ All data from the table will be exported unless limitations are specified. This
946
946
| UCClient ||
947
947
| UCDOAggregatedStatus ||
948
948
| UCDOStatus ||
949
-
| Update | Partial support. Some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
949
+
| Update | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
950
950
| UpdateRunProgress ||
951
951
| UpdateSummary ||
952
952
| UrlClickEvents ||
@@ -955,11 +955,11 @@ All data from the table will be exported unless limitations are specified. This
955
955
| UserPeerAnalytics ||
956
956
| VIAudit ||
957
957
| VIIndexing ||
958
-
| W3CIISLog | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
958
+
| W3CIISLog | Partial support. Data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
959
959
| Watchlist ||
960
960
| WindowsEvent ||
961
961
| WindowsFirewall ||
962
-
| WireData | Partial support. Some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
962
+
| WireData | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
0 commit comments