Merge pull request #232260 from bwren/patch-57

prmerger-automator[bot] · web-flow · commit 71319400525f · 2023-03-28T00:36:57.000Z
Update data-collection-transformations.md
diff --git a/articles/azure-monitor/essentials/data-collection-transformations.md b/articles/azure-monitor/essentials/data-collection-transformations.md
@@ -142,7 +142,7 @@ The following example is a DCR for Azure Monitor Agent that sends data to the `S
                   "streams": [ 
                     "Microsoft-Syslog" 
                   ], 
-                  "transformKql": "source | where message contains 'error'", 
+                  "transformKql": "source | where message has 'error'", 
                   "destinations": [ 
                     "centralWorkspace" 
                   ] 
@@ -214,7 +214,7 @@ The following example is a DCR for data from the Logs Ingestion API that sends d
                         "destinations": [ 
                             "clv2ws1" 
                         ], 
-                        "transformKql": "source | where (AdditionalContext contains 'malicious traffic!' | project TimeGenerated = Time, Computer, Subject = AdditionalContext", 
+                        "transformKql": "source | where (AdditionalContext has 'malicious traffic!' | project TimeGenerated = Time, Computer, Subject = AdditionalContext", 
                         "outputStream": "Microsoft-SecurityEvent" 
                     } 
                 ] 

Original file line number	Diff line number	Diff line change
@@ -142,7 +142,7 @@ The following example is a DCR for Azure Monitor Agent that sends data to the `S
`142`	`142`	`"streams": [`
`143`	`143`	`"Microsoft-Syslog"`
`144`	`144`	`],`
`145`		`- "transformKql": "source \| where message contains 'error'",`
	`145`	`+ "transformKql": "source \| where message has 'error'",`
`146`	`146`	`"destinations": [`
`147`	`147`	`"centralWorkspace"`
`148`	`148`	`]`
`@@ -214,7 +214,7 @@ The following example is a DCR for data from the Logs Ingestion API that sends d`
`214`	`214`	`"destinations": [`
`215`	`215`	`"clv2ws1"`
`216`	`216`	`],`
`217`		`- "transformKql": "source \| where (AdditionalContext contains 'malicious traffic!' \| project TimeGenerated = Time, Computer, Subject = AdditionalContext",`
	`217`	`+ "transformKql": "source \| where (AdditionalContext has 'malicious traffic!' \| project TimeGenerated = Time, Computer, Subject = AdditionalContext",`
`218`	`218`	`"outputStream": "Microsoft-SecurityEvent"`
`219`	`219`	`}`
`220`	`220`	`]`