You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-export-logic-app.md
+78-84Lines changed: 78 additions & 84 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -56,138 +56,132 @@ Use the procedure in [Create a container](../../storage/blobs/storage-quickstart
56
56
57
57
## Create Logic App
58
58
59
-
Go to **Logic Apps** in the Azure portal and click **Add**. Select a **Subscription**, **Resource group**, and **Region** to store the new Logic App and then give it a unique name. You can turn on **Log Analytics** setting to collect information about runtime data and events as described in [Set up Azure Monitor logs and collect diagnostics data for Azure Logic Apps](../../logic-apps/monitor-logic-apps-log-analytics.md). This setting isn't required for using the Azure Monitor Logs connector.
59
+
1.Go to **Logic Apps** in the Azure portal and click **Add**. Select a **Subscription**, **Resource group**, and **Region** to store the new Logic App and then give it a unique name. You can turn on **Log Analytics** setting to collect information about runtime data and events as described in [Set up Azure Monitor logs and collect diagnostics data for Azure Logic Apps](../../logic-apps/monitor-logic-apps-log-analytics.md). This setting isn't required for using the Azure Monitor Logs connector.
Click **Review + create** and then **Create**. When the deployment is complete, click **Go to resource** to open the **Logic Apps Designer**.
64
+
2.Click **Review + create** and then **Create**. When the deployment is complete, click **Go to resource** to open the **Logic Apps Designer**.
65
65
66
66
## Create a trigger for the Logic App
67
-
Under **Start with a common trigger**, select **Recurrence**. This creates a Logic App that automatically runs at a regular interval. In the **Frequency** box of the action, select **Day** and in the **Interval** box, enter **1** to run the workflow once per day.
67
+
3.Under **Start with a common trigger**, select **Recurrence**. This creates a Logic App that automatically runs at a regular interval. In the **Frequency** box of the action, select **Day** and in the **Interval** box, enter **1** to run the workflow once per day.
Click **+ New step** to add an action that runs after the recurrence action. Under **Choose an action**, type **azure monitor** and then select **Azure Monitor Logs**.
73
+
4.Click **+ New step** to add an action that runs after the recurrence action. Under **Choose an action**, type **azure monitor** and then select **Azure Monitor Logs**.
Click **Azure Log Analytics – Run query and list results**.
77
+
5.Click **Azure Log Analytics – Run query and list results**.
78
78
79
-
[](media/logs-export-logic-app/select-query-action-list.png#lightbox)
80
-
81
-
You will be prompted to select a tenant to grant access to the Log Analytics workspace with the account that the workflow will use to run the query.
79
+
[](media/logs-export-logic-app/select-query-action-list.png#lightbox)
82
80
81
+
You will be prompted to select a tenant to grant access to the Log Analytics workspace with the account that the workflow will use to run the query.
83
82
84
83
## Add Azure Monitor Logs action
85
-
The Azure Monitor Logs action lets you specify the query to run. The log query used in this example is optimized for hourly recurrence and collects the data ingested for the particular execution time. For example, if the workflow runs at 4:35, the time range would be 3:00 to 4:00. If you change the Logic App to run at a different frequency, you need the change the query as well. For example, if you set the recurrence to run daily, you would set startTime in the query to startofday(make_datetime(year,month,day,0,0)).
86
-
87
-
Select the **Subscription** and **Resource Group** for your Log Analytics workspace. Select *Log Analytics Workspace* for the **Resource Type** and then select the workspace's name under **Resource Name**.
88
-
89
-
Add the following log query to the **Query** window.
90
-
91
-
```Kusto
92
-
let dt = now();
93
-
let year = datetime_part('year', dt);
94
-
let month = datetime_part('month', dt);
95
-
let day = datetime_part('day', dt);
96
-
let hour = datetime_part('hour', dt);
97
-
let startTime = make_datetime(year,month,day,hour,0)-1h;
98
-
let endTime = startTime + 1h - 1tick;
99
-
AzureActivity
100
-
| where ingestion_time() between(startTime .. endTime)
The **Time Range** specifies the records that will be included in the query based on the **TimeGenerated** column. This should be set to a value greater than the time range selected in the query. Since this query isn't using the **TimeGenerated** column, then **Set in query** option isn't available. See [Query scope](./scope.md) for more details about the time range.
117
-
118
-
Select **Last 4 hours** for the **Time Range**. This will ensure that any records with a ingestion time larger than **TimeGenerated** will be included in the results.
84
+
6. The Azure Monitor Logs action lets you specify the query to run. The log query used in this example is optimized for hourly recurrence and collects the data ingested for the particular execution time. For example, if the workflow runs at 4:35, the time range would be 3:00 to 4:00. If you change the Logic App to run at a different frequency, you need the change the query as well. For example, if you set the recurrence to run daily, you would set startTime in the query to startofday(make_datetime(year,month,day,0,0)).
85
+
86
+
7. Select the **Subscription** and **Resource Group** for your Log Analytics workspace. Select *Log Analytics Workspace* for the **Resource Type** and then select the workspace's name under **Resource Name**.
87
+
88
+
8. Add the following log query to the **Query** window.
89
+
90
+
```Kusto
91
+
let dt = now();
92
+
let year = datetime_part('year', dt);
93
+
let month = datetime_part('month', dt);
94
+
let day = datetime_part('day', dt);
95
+
let hour = datetime_part('hour', dt);
96
+
let startTime = make_datetime(year,month,day,hour,0)-1h;
97
+
let endTime = startTime + 1h - 1tick;
98
+
AzureActivity
99
+
| where ingestion_time() between(startTime .. endTime)
9. The **Time Range** specifies the records that will be included in the query based on the **TimeGenerated** column. This should be set to a value greater than the time range selected in the query. Since this query isn't using the **TimeGenerated** column, then **Set in query** option isn't available. See [Query scope](./scope.md) for more details about the time range. Select **Last 4 hours** for the **Time Range**. This will ensure that any records with an ingestion time larger than **TimeGenerated** will be included in the results.
119
116
120
-
[](media/logs-export-logic-app/run-query-list-action.png#lightbox)
121
-
117
+
[](media/logs-export-logic-app/run-query-list-action.png#lightbox)
122
118
123
119
### Add Parse JSON activity (optional)
124
120
The output from the **Run query and list results** action is formatted in JSON. You can parse this data and manipulate it as part of the preparation for **Compose** action.
125
121
126
122
You can provide a JSON schema that describes the payload you expect to receive. The designer parses JSON content by using this schema and generates user-friendly tokens that represent the properties in your JSON content. You can then easily reference and use those properties throughout your Logic App's workflow.
127
123
128
124
129
-
Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **json** and then select **Parse JSON**.
125
+
11. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **json** and then select **Parse JSON**.
Click in the **Content** box to display a list of values from previous activities. Select **Body** from the **Run query and list results** action. This is the output from the log query.
129
+
12. Click in the **Content** box to display a list of values from previous activities. Select **Body** from the **Run query and list results** action. This is the output from the log query.
5. Click **Use sample payload to generate schema**. Run the log query and copy the output to use for the sample payload. For the sample query here, you can use the following output:
133
+
13. Click **Use sample payload to generate schema**. Run the log query and copy the output to use for the sample payload. For the sample query here, you can use the following output:
138
134
139
135
140
-
```json
141
-
{
142
-
"TimeGenerated": "2020-09-29T23:11:02.578Z",
143
-
"BlobTime": "2020-09-29T23:00:00Z",
144
-
"OperationName": "Returns Storage Account SAS Token",
Click the **Inputs** box display a list of values from previous activities. Select **Body** from the **Parse JSON** action. This is the parsed output from the log query.
168
162
169
-
[](media/logs-export-logic-app/select-body-compose.png#lightbox)
163
+
15. Click the **Inputs** box display a list of values from previous activities. Select **Body** from the **Parse JSON** action. This is the parsed output from the log query.
170
164
165
+
[](media/logs-export-logic-app/select-body-compose.png#lightbox)
171
166
172
167
## Add the Create Blob action
173
168
The Create Blob action writes the composed JSON to storage.
174
169
175
-
Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **blob** and then select the **Create Blob** action.
16. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **blob** and then select the **Create Blob** action.
178
171
179
-
Type a name for the connection to your Storage Account in **Connection Name** and then click the folder icon in the **Folder path** box to select the container in your Storage Account. Click the **Blob name** to see a list of values from previous activities. Click **Expression** and enter an expression that matches your time interval. For this query which is run hourly, the following expression sets the blob name per previous hour:
17. Type a name for the connection to your Storage Account in **Connection Name** and then click the folder icon in the **Folder path** box to select the container in your Storage Account. Click the **Blob name** to see a list of values from previous activities. Click **Expression** and enter an expression that matches your time interval. For this query which is run hourly, the following expression sets the blob name per previous hour:
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/move-workspace.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,7 +28,7 @@ The workspace source and destination subscriptions must exist within the same Az
28
28
## Workspace move considerations
29
29
- Managed solutions that are installed in the workspace will be moved in this operation.
30
30
- Workspace keys (both primary and secondary) are re-generated with workspace move operation. If you keep a copy of your workspace keys in key vault, update them with the new keys generated after the workspace move.
31
-
- Connected [MMA agents](../agents/log-analytics-agent.md) will remain connected and keep send data to the workspace after the move. [AMA agents](../agents/azure-monitor-agent-overview.md) via DCR will be disconnected during the move and should be reconfigured after the move.
31
+
- Connected [MMA agents](../agents/log-analytics-agent.md) will remain connected and keep sending data to the workspace after the move. [AMA agents](../agents/azure-monitor-agent-overview.md) via DCR will be disconnected during the move and should be reconfigured after the move.
32
32
- Since the move operation requires that there are no Linked Services from the workspace, solutions that rely on that link must be removed to allow the workspace move. Solutions that must be removed before you can unlink your automation account:
0 commit comments