You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/parse-text.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,14 +15,14 @@ This article describes different options for parsing log data in Azure Monitor w
15
15
16
16
## Permissions required
17
17
18
-
- To parse data at collection time, you need `microsoft.operationalinsights/workspaces/customfields/write` permissions, as provided by the [Log Analytics Contributor built-in role](./manage-access.md#log-analytics-contributor), for example.
18
+
- To parse data at collection time, you need `Microsoft.Insights/dataCollectionRuleAssociations/*` permissions, as provided by the [Log Analytics Contributor built-in role](./manage-access.md#log-analytics-contributor), for example.
19
19
- To parse data at query time, you need `Microsoft.OperationalInsights/workspaces/query/*/read` permissions, as provided by the [Log Analytics Reader built-in role](./manage-access.md#log-analytics-reader), for example.
20
20
21
21
## Parsing methods
22
22
You can parse data either at ingestion time when the data is collected or at query time when you analyze the data with a query. Each strategy has unique advantages.
23
23
24
24
### Parse data at collection time
25
-
When you parse data at collection time, you configure [custom fields](../logs/custom-fields.md) that create new properties in the table. Queries don't have to include any parsing logic and use these properties as any other field in the table.
25
+
When you parse data at collection time, you create [transformations](../essentials/data-collection-transformations.md) that create new properties in the table. Queries don't have to include any parsing logic and use these properties as any other field in the table.
26
26
27
27
**Advantages:**
28
28
@@ -53,7 +53,7 @@ When you parse data at query time, you include logic in your query to parse data
53
53
- Can create overhead when you run complex logic against very large record sets (billions of records).
54
54
55
55
## Parse data as it's collected
56
-
For more information on parsing data as it's collected, see [Create custom fields in Azure Monitor](../logs/custom-fields.md). This approach creates custom properties in the table that can be used by queries like any other property.
56
+
For more information on parsing data as it's collected, see [Structure of transformation in Azure Monitor](../essentials/data-collection-transformations-structure.md). This approach creates custom properties in the table that can be used by queries like any other property.
57
57
58
58
## Parse data in a query by using patterns
59
59
When the data you want to parse can be identified by a pattern repeated across records, you can use different operators in the [Kusto Query Language](/azure/kusto/query/) to extract the specific piece of data into one or more new properties.
0 commit comments