Merge pull request #191825 from guywi-ms/guywild-ms-basic-logs-updates

Updates to Basic Log docs

Author: tamarakhader

articles/azure-monitor/logs/azure-cli-log-analytics-workspace-sample.md

@@ -60,8 +60,7 @@ You can delete [Custom Log](custom-logs-overview.md), [Search Results](search-jo
 To delete a table, run the [az monitor log-analytics workspace table delete](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-data-export-delete) command:
 
 ```azurecli
-az monitor log-analytics workspace table delete –subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name MySearchTable_SRCH
+az monitor log-analytics workspace table delete –subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name MySearchTable_SRCH
 ```
 
 ## Export data from selected tables

articles/azure-monitor/logs/basic-logs-configure.md

@@ -103,15 +103,13 @@ For example:
 - To set Basic Logs:
 
     ```azurecli
-    az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-       --name ContainerLog  --plan Basic
+    az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLog  --plan Basic
     ```
 
 - To set Analytics Logs:
 
     ```azurecli
-    az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name ContainerLog  --plan Analytics
+    az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLog  --plan Analytics
     ```
    
 ---
@@ -183,8 +181,7 @@ To check the configuration of a table, run the [az monitor log-analytics workspa
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name Syslog  --output table \ 
+az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name Syslog --output table  
 ```
 
 ---

articles/azure-monitor/logs/basic-logs-query.md

@@ -7,12 +7,15 @@ ms.date: 01/27/2022
 ---
 
 # Query Basic Logs in Azure Monitor (Preview)
-Basic Logs reduce the cost of high-volume verbose logs you don’t need for analytics and alerts. Basic Logs have reduced charges for ingestion and limitations on log queries and other Azure Monitor features. This article describes how to query data from tables configured for Basic Logs in the Azure portal and using the Log Analytics REST API. 
+Basic Logs tables reduce the cost of ingesting high-volume verbose logs and let you query the data they store using a limited set of log queries. This article explains how to query data from Basic Logs tables. 
+
+For more information, see [Azure log data plans](log-analytics-workspace-overview.md#log-data-plans-preview) and [Configure a table for Basic Logs](basic-logs-configure.md). 
+
 
 > [!NOTE]
 > Other tools that use the Azure API for querying - for example, Grafana and Power BI - cannot access Basic Logs. 
 
-## Limits
+## Limitations
 Queries with Basic Logs are subject to the following limitations:
 ### KQL language limits
 Log queries against Basic Logs are optimized for simple data retrieval using a subset of KQL language, including the following operators: 
@@ -33,38 +36,43 @@ You can use all functions and binary operators within these operators.
 Specify the time range in the query header in Log Analytics or in the API call. You can't specify the time range in the query body using a **where** statement.
 
 ### Query context
-Queries with Basic Logs must use a workspace for the scope. You can't run queries using another resource for the scope. For more details, see [Log query scope and time range in Azure Monitor Log Analytics](scope.md).
+Queries with Basic Logs must use a workspace for the scope. You can't run queries using another resource for the scope. For more information, see [Log query scope and time range in Azure Monitor Log Analytics](scope.md).
 
 ### Concurrent queries
 You can run two concurrent queries per user. 
 
 ### Purge
-You cannot [purge personal data](personal-data-mgmt.md#how-to-export-and-delete-private-data) from Basic Logs tables. 
+You can’t [purge personal data](personal-data-mgmt.md#how-to-export-and-delete-private-data) from Basic Logs tables. 
 
 
-## Run a query from the Azure portal
+## Run a query on a Basic Logs table
 Creating a query using Basic Logs is the same as any other query in Log Analytics. See [Get started with Azure Monitor Log Analytics](./log-analytics-tutorial.md) if you aren't familiar with this process.
 
-Open Log Analytics in the Azure portal and open the **Tables** tab. When browsing the list of tables, Basic Logs tables are identified with a unique icon: 
+# [Portal](#tab/portal-1)
+
+In the Azure portal, select **Monitor** > **Logs** > **Tables**.
+
+In the list of tables, you can identify Basic Logs tables by their unique icon: 
 
 ![Screenshot of the Basic Logs table icon in the table list.](./media/basic-logs-configure/table-icon.png)
 
-You can also hover over a table name for the table information view. This will specify that the table is configured as Basic Logs:
+You can also hover over a table name for the table information view, which will specify that the table is configured as Basic Logs:
 
 ![Screenshot of the Basic Logs table indicator in the table details.](./media/basic-logs-configure/table-info.png)
 
-
 When you add a table to the query, Log Analytics will identify a Basic Logs table and align the authoring experience accordingly. The following example shows when you attempt to use an operator that isn't supported by Basic Logs.
 
 ![Screenshot of Query on Basic Logs limitations.](./media/basic-logs-query/query-validator.png)
 
-## Run a query from REST API
+# [API](#tab/api-1)
+
 Use **/search** from the [Log Analytics API](api/overview.md) to run a query with Basic Logs using a REST API. This is similar to the [/query](api/request-format.md) API with the following differences:
 
 - The query is subject to the language limitations described above.
 - The time span must be specified in the header of the request and not in the query statement.
 
-### Sample Request
+**Sample Request**
+
 ```http
 https://api.loganalytics.io/v1/workspaces/testWS/search?timespan=P1D
 ```
@@ -77,7 +85,8 @@ https://api.loganalytics.io/v1/workspaces/testWS/search?timespan=P1D
 }
 ```
 
-## Costs
+---
+## Pricing model
 The charge for a query on Basic Logs is based on the amount of data the query scans, not just the amount of data the query returns. For example, a query that scans three days of data in a table that ingests 100 GB each day, would be charged for 300 GB. Calculation is based on chunks of up to one day of data. 
 
 For more information, see [Azure Monitor pricing](https://azure.microsoft.com/pricing/details/monitor/).

articles/azure-monitor/logs/data-retention-archive.md

@@ -118,17 +118,15 @@ To set the retention and archive duration for a table, run the [az monitor log-a
 This example sets table's interactive retention to 30 days, and the total retention to two years. This means the archive duration is 23 months:
 
 ```azurecli
-az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
---name AzureMetrics --retention-time 30 --total-retention-time 730
+az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name AzureMetrics --retention-time 30 --total-retention-time 730
 ```
 
 To reapply the workspace's default interactive retention value to the table and reset its total retention to 0, run the [az monitor log-analytics workspace table update](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-update) command with the `--retention-time` and `--total-retention-time` parameters set to `-1`.
 
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name Syslog --retention-time -1 --total-retention-time -1
+az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name Syslog --retention-time -1 --total-retention-time -1
 ```
 
 ---
@@ -156,8 +154,7 @@ To get the retention policy of a particular table, run the [az monitor log-analy
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name SecurityEvent
+az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name SecurityEvent
 ``` 
 
 ---

articles/azure-monitor/logs/restore.md

@@ -80,8 +80,7 @@ To restore data from a table, run the [az monitor log-analytics workspace table
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table restore create --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name Heartbeat_RST --restore-source-table Heartbeat --start-restore-time "2022-01-01T00:00:00.000Z" --end-restore-time "2022-01-08T00:00:00.000Z" --no-wait
+az monitor log-analytics workspace table restore create --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name Heartbeat_RST --restore-source-table Heartbeat --start-restore-time "2022-01-01T00:00:00.000Z" --end-restore-time "2022-01-08T00:00:00.000Z" --no-wait
 ```
 
 ---
@@ -107,8 +106,7 @@ To delete a restore table, run the [az monitor log-analytics workspace table del
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table delete --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name Heartbeat_RST
+az monitor log-analytics workspace table delete --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name Heartbeat_RST
 ```
 
 ---

articles/azure-monitor/logs/search-jobs.md

@@ -96,9 +96,7 @@ To run a search job, run the [az monitor log-analytics workspace table search-jo
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table search-job create --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name HeartbeatByIp_SRCH --search-query 'Heartbeat | where ComputerIP has "00.000.00.000"' --limit 1500 \ 
-   --start-search-time "2022-01-01T00:00:00.000Z" --end-search-time "2022-01-08T00:00:00.000Z" --no-wait
+az monitor log-analytics workspace table search-job create --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name HeartbeatByIp_SRCH --search-query 'Heartbeat | where ComputerIP has "00.000.00.000"' --limit 1500 --start-search-time "2022-01-01T00:00:00.000Z" --end-search-time "2022-01-08T00:00:00.000Z" --no-wait
 ```
 
 ---
@@ -175,8 +173,7 @@ To check the status and details of a search job table, run the [az monitor log-a
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name HeartbeatByIp_SRCH  --output table \
+az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name HeartbeatByIp_SRCH --output table \
 ```
 
 ---
@@ -199,8 +196,7 @@ To delete a search table, run the [az monitor log-analytics workspace table dele
 For example:
 
 ```azurecli
-az monitor log-analytics workspace table delete --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace \
-   --name HeartbeatByIp_SRCH
+az monitor log-analytics workspace table delete --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name HeartbeatByIp_SRCH
 ```
 
 ---