You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/custom-fields-migrate.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.date: 03/31/2023
9
9
10
10
# Tutorial: Replace custom fields in Log Analytics workspace with KQL-based custom columns
11
11
12
-
Custom fields is a feature of Azure Monitor that allows you to extract into a separate column data from a different text column of the same table. Creation of new custom fields will be disabled starting March 31st, 2023. Custom fields functionality will be deprecated and existing custom fields will stop functioning on March 31st, 2026.
12
+
Custom fields is a feature of Azure Monitor that allows you to extract into a separate column data from a different text column of the same table. Creation of new custom fields will be disabled starting March 31, 2023. Custom fields functionality will be deprecated and existing custom fields will stop functioning on March 31, 2026.
13
13
14
14
There are several advantages to using DCR-based [ingestion-time transformations](../essentials/data-collection-transformations.md) to accomplish the same result:
15
15
@@ -64,8 +64,8 @@ Since there is no way to examine the custom field definition directly, you need
64
64
65
65
1. Locate the columns noted in the previous step and examine their content.
66
66
- If the column *is not empty* and *there are DCRs* associated with the table, then custom field logic has been already implemented with transformation. No action is required
67
-
- If the column *is empty* (or not present in query results) and *there are DCRs* associated with the table, the custom field logic was not implemented with the DCR. Add a transformation to the dataflow in the existing DCR.
68
-
- If the column *is not empty* and *there are no DCRs* associated with the table, the custom field logic needs to implemented as a transformation in the [workspace DCR](../essentials/data-collection-transformations-workspace.md).
67
+
- If the column *is empty* (or not present in query results) and *there are DCRs* associated with the table, the custom field logic wasn't implemented with the DCR. Add a transformation to the dataflow in the existing DCR.
68
+
- If the column *isn't empty* and *there are no DCRs* associated with the table, the custom field logic needs to implemented as a transformation in the [workspace DCR](../essentials/data-collection-transformations-workspace.md).
69
69
70
70
1. Examine the content of the custom field and determine the logic how it's being calculated. Custom fields usually calculate substrings of other columns in the same table. Determine which column the data comes from and the portion of the string it extracts.
71
71
@@ -76,7 +76,7 @@ You're now ready to create the required KQL snippet and add it to a DCR. This lo
76
76
77
77
- Use [parse](/azure/data-explorer/kusto/query/parseoperator) operator for pattern-based search of a substring within a string.
78
78
- Use [extract()](/azure/data-explorer/kusto/query/extractfunction) function for regex-based substring search.
79
-
- String functions as [split()](/azure/data-explorer/kusto/query/splitfunction), [substring()](/azure/data-explorer/kusto/query/substringfunction) and [many others](/azure/data-explorer/kusto/query/scalarfunctions#string-functions) may also be useful.
79
+
- String functions as [split()](/azure/data-explorer/kusto/query/splitfunction), [substring()](/azure/data-explorer/kusto/query/substringfunction), and [many others](/azure/data-explorer/kusto/query/scalarfunctions#string-functions) may also be useful.
80
80
81
81
:::image type="content" source="media/custom-fields-migrate/log-analytics-transformation-query.png" alt-text="Screenshot of Log Analytics with query returning data using transformation query" lightbox="media/custom-fields-migrate/log-analytics-transformation-query.png":::
82
82
@@ -91,15 +91,15 @@ You're now ready to create the required KQL snippet and add it to a DCR. This lo
91
91
92
92
### How do I migrate custom fields for a text log collected with legacy Log Analytics agent (MMA)?
93
93
94
-
Consider migrating to Azure Monitor Agent (AMA). Log Analytics agent is approaching its end of support, and you should migrate to Azure Monitor Agent (AMA). [Text logs collected with AMA](../agents/data-collection-text-log.md) use log parsing logic defined in form of KQL transformations from the start. Custom fields are not required and not supported in text logs collected by Azure Monitor Agent.
94
+
Consider migrating to Azure Monitor Agent (AMA). Log Analytics agent is approaching its end of support, and you should migrate to Azure Monitor Agent (AMA). [Text logs collected with AMA](../agents/data-collection-text-log.md) use log parsing logic defined in form of KQL transformations from the start. Custom fields aren't required and not supported in text logs collected by Azure Monitor Agent.
95
95
96
96
### Is migration of custom fields to KQL mandatory?
97
97
98
-
No. You need to migrate your custom fields only if you still want your custom columns populated. If you don't migrate your custom fields, corresponding columns will stop being populated when support of custom fields is ended. Data that has been already processed and stored in the table will not be affected and will remain usable.
98
+
No, you need to migrate your custom fields only if you still want your custom columns populated. If you don't migrate your custom fields, corresponding columns will stop being populated when support of custom fields is ended. Data that has been already processed and stored in the table won't be affected and will remain usable.
99
99
100
100
### Will I lose my existing data in corresponding columns if I don't migrate my custom fields in time?
101
101
102
-
No. Custom fields are calculated at the time of data ingestion. Deleting the field definition or not migrating them in time will not affect any data previously ingested.
102
+
No, custom fields are calculated at the time of data ingestion. Deleting the field definition or not migrating them in time won't affect any data previously ingested.
0 commit comments