You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-data-export.md
+86-6Lines changed: 86 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -642,6 +642,7 @@ All data from the table will be exported unless limitations are specified. This
642
642
|:---|:---|
643
643
| AACAudit ||
644
644
| AACHttpRequest ||
645
+
| AADB2CRequestLogs ||
645
646
| AADDomainServicesAccountLogon ||
646
647
| AADDomainServicesAccountManagement ||
647
648
| AADDomainServicesDirectoryServiceAccess ||
@@ -657,23 +658,35 @@ All data from the table will be exported unless limitations are specified. This
657
658
| AADServicePrincipalSignInLogs ||
658
659
| AADUserRiskEvents ||
659
660
| ABSBotRequests ||
661
+
| ACICollaborationAudit ||
660
662
| ACRConnectedClientList ||
661
663
| ACSAuthIncomingOperations ||
662
664
| ACSBillingUsage ||
665
+
| ACSCallAutomationIncomingOperations ||
663
666
| ACSCallDiagnostics ||
667
+
| ACSCallRecordingSummary ||
664
668
| ACSCallSummary ||
665
669
| ACSChatIncomingOperations ||
670
+
| ACSEmailSendMailOperational ||
671
+
| ACSEmailStatusUpdateOperational ||
672
+
| ACSEmailUserEngagementOperational ||
673
+
| ACSNetworkTraversalDiagnostics ||
666
674
| ACSNetworkTraversalIncomingOperations ||
675
+
| ACSRoomsIncomingOperations ||
667
676
| ACSSMSIncomingOperations ||
668
677
| ADAssessmentRecommendation ||
669
678
| ADFActivityRun ||
679
+
| ADFAirflowTaskLogs ||
680
+
| ADFAirflowWorkerLogs ||
670
681
| ADFPipelineRun ||
671
682
| ADFSSignInLogs ||
672
683
| ADFTriggerRun ||
673
684
| ADPAudit ||
685
+
| ADPDiagnostics ||
674
686
| ADPRequests ||
675
687
| ADReplicationResult ||
676
688
| ADSecurityAssessmentRecommendation ||
689
+
| ADTDataHistoryOperation ||
677
690
| ADTDigitalTwinsOperation ||
678
691
| ADTEventRoutesOperation ||
679
692
| ADTModelsOperation ||
@@ -684,22 +697,37 @@ All data from the table will be exported unless limitations are specified. This
684
697
| AegDeliveryFailureLogs ||
685
698
| AegPublishFailureLogs ||
686
699
| AEWAuditLogs ||
700
+
| AEWComputePipelinesLogs ||
687
701
| AgriFoodApplicationAuditLogs ||
688
702
| AgriFoodFarmManagementLogs ||
689
703
| AgriFoodFarmOperationLogs ||
704
+
| AgriFoodInsightLogs ||
690
705
| AgriFoodJobProcessedLogs ||
706
+
| AgriFoodModelInferenceLogs ||
707
+
| AgriFoodProviderAuthLogs ||
708
+
| AgriFoodSatelliteLogs ||
709
+
| AgriFoodSensorManagementLogs ||
710
+
| AgriFoodWeatherLogs ||
691
711
| AGSGrafanaLoginEvents ||
712
+
| AHDSMedTechDiagnosticLogs ||
692
713
| Alert | Partial support – Data ingestion for Zabbix alerts isn't supported. |
693
714
| AlertEvidence ||
694
715
| AlertInfo ||
695
716
| AmlOnlineEndpointConsoleLog ||
717
+
| AmlOnlineEndpointEventLog ||
718
+
| AmlOnlineEndpointTrafficLog ||
719
+
| AMSKeyDeliveryRequests ||
720
+
| AMSLiveEventOperations ||
721
+
| AMSMediaAccountHealth ||
722
+
| AMSStreamingEndpointRequests ||
723
+
| ANFFileAccess ||
696
724
| ApiManagementGatewayLogs ||
697
725
| AppAvailabilityResults ||
698
726
| AppBrowserTimings ||
699
727
| AppCenterError ||
728
+
| AppDependencies ||
700
729
| AppEvents ||
701
730
| AppExceptions ||
702
-
| AppDependencies ||
703
731
| AppMetrics ||
704
732
| AppPageViews ||
705
733
| AppPerformanceCounters ||
@@ -711,21 +739,39 @@ All data from the table will be exported unless limitations are specified. This
711
739
| AppServiceFileAuditLogs ||
712
740
| AppServiceHTTPLogs ||
713
741
| AppServicePlatformLogs ||
742
+
| AppServiceServerlessSecurityPluginData ||
714
743
| AppSystemEvents ||
715
744
| AppTraces ||
716
745
| ASimDnsActivityLogs ||
746
+
| ASimNetworkSessionLogs ||
717
747
| ATCExpressRouteCircuitIpfix ||
718
748
| AuditLogs ||
719
749
| AutoscaleEvaluationsLog ||
720
750
| AutoscaleScaleActionsLog ||
751
+
| AVSSyslog ||
721
752
| AWSCloudTrail ||
722
753
| AWSGuardDuty ||
723
754
| AWSVPCFlow ||
755
+
| AZFWApplicationRule ||
756
+
| AZFWApplicationRuleAggregation ||
757
+
| AZFWDnsQuery ||
758
+
| AZFWFatFlow ||
759
+
| AZFWFlowTrace ||
760
+
| AZFWIdpsSignature ||
761
+
| AZFWInternalFqdnResolutionFailure ||
762
+
| AZFWNatRule ||
763
+
| AZFWNatRuleAggregation ||
764
+
| AZFWNetworkRule ||
765
+
| AZFWNetworkRuleAggregation ||
766
+
| AZFWThreatIntel ||
724
767
| AzureAssessmentRecommendation ||
725
768
| AzureAttestationDiagnostics ||
726
769
| AzureDevOpsAuditing ||
770
+
| AzureLoadTestingOperation ||
727
771
| BehaviorAnalytics ||
772
+
| CassandraAudit ||
728
773
| CassandraLogs ||
774
+
| CCFApplicationLogs ||
729
775
| CDBCassandraRequests ||
730
776
| CDBControlPlaneRequests ||
731
777
| CDBDataPlaneRequests ||
@@ -739,7 +785,10 @@ All data from the table will be exported unless limitations are specified. This
739
785
| CloudAppEvents ||
740
786
| CommonSecurityLog ||
741
787
| ComputerGroup ||
788
+
| ConfidentialWatchlist ||
742
789
| ConfigurationData | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
790
+
| ContainerAppConsoleLogs ||
791
+
| ContainerAppSystemLogs ||
743
792
| ContainerImageInventory ||
744
793
| ContainerInventory ||
745
794
| ContainerLog ||
@@ -757,12 +806,17 @@ All data from the table will be exported unless limitations are specified. This
757
806
| DatabricksSQLPermissions ||
758
807
| DatabricksSSH ||
759
808
| DatabricksWorkspace ||
809
+
| DevCenterDiagnosticLogs ||
810
+
| DeviceTvmSecureConfigurationAssessment ||
811
+
| DeviceTvmSoftwareInventory ||
812
+
| DeviceTvmSoftwareVulnerabilities ||
760
813
| DnsEvents ||
761
814
| DnsInventory ||
762
815
| DSMAzureBlobStorageLogs ||
763
816
| DSMDataClassificationLogs ||
764
817
| DSMDataLabelingLogs ||
765
818
| Dynamics365Activity ||
819
+
| DynamicSummary ||
766
820
| EmailAttachmentInfo ||
767
821
| EmailEvents ||
768
822
| EmailPostDeliveryEvents ||
@@ -771,8 +825,10 @@ All data from the table will be exported unless limitations are specified. This
771
825
| ExchangeAssessmentRecommendation ||
772
826
| FailedIngestion ||
773
827
| FunctionAppLogs ||
828
+
| GCPAuditLogs ||
774
829
| HDInsightAmbariClusterAlerts ||
775
830
| HDInsightAmbariSystemMetrics ||
831
+
| HDInsightGatewayAuditLogs ||
776
832
| HDInsightHadoopAndYarnLogs ||
777
833
| HDInsightHadoopAndYarnMetrics ||
778
834
| HDInsightHBaseLogs ||
@@ -781,20 +837,26 @@ All data from the table will be exported unless limitations are specified. This
781
837
| HDInsightHiveAndLLAPMetrics ||
782
838
| HDInsightHiveQueryAppStats ||
783
839
| HDInsightHiveTezAppStats ||
840
+
| HDInsightJupyterNotebookEvents ||
784
841
| HDInsightKafkaLogs ||
785
842
| HDInsightKafkaMetrics ||
786
843
| HDInsightOozieLogs ||
844
+
| HDInsightRangerAuditLogs ||
787
845
| HDInsightSecurityLogs ||
788
846
| HDInsightSparkApplicationEvents ||
789
847
| HDInsightSparkBlockManagerEvents ||
790
848
| HDInsightSparkEnvironmentEvents ||
791
849
| HDInsightSparkExecutorEvents ||
850
+
| HDInsightSparkExtraEvents ||
792
851
| HDInsightSparkJobEvents ||
793
852
| HDInsightSparkLogs ||
794
853
| HDInsightSparkSQLExecutionEvents ||
795
854
| HDInsightSparkStageEvents ||
796
855
| HDInsightSparkStageTaskAccumulables ||
797
856
| HDInsightSparkTaskEvents ||
857
+
| HDInsightStormLogs ||
858
+
| HDInsightStormMetrics ||
859
+
| HDInsightStormTopologyMetrics ||
798
860
| Heartbeat ||
799
861
| HuntingBookmark ||
800
862
| IdentityDirectoryEvents ||
@@ -812,24 +874,36 @@ All data from the table will be exported unless limitations are specified. This
812
874
| KubeServices ||
813
875
| LAQueryLogs ||
814
876
| McasShadowItReporting ||
877
+
| MCCEventLogs ||
815
878
| MCVPAuditLogs ||
816
879
| MCVPOperationLogs ||
817
880
| MicrosoftAzureBastionAuditLogs ||
818
881
| MicrosoftDataShareReceivedSnapshotLog ||
819
882
| MicrosoftDataShareSentSnapshotLog ||
820
883
| MicrosoftHealthcareApisAuditLogs ||
884
+
| MicrosoftPurviewInformationProtection ||
885
+
| NetworkAccessTraffic ||
886
+
| NSPAccessLogs ||
821
887
| NWConnectionMonitorPathResult ||
822
888
| NWConnectionMonitorTestResult ||
823
-
| OfficeActivity | Partial support in government clouds – some of the data to ingested via webhooks from O365 into LA. This portion is missing in export currently. |
889
+
| OEPAirFlowTask ||
890
+
| OEPElasticOperator ||
891
+
| OEPElasticsearch ||
892
+
| OfficeActivity ||
824
893
| OLPSupplyChainEntityOperations ||
825
894
| OLPSupplyChainEvents ||
826
895
| Operation | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
827
896
| Perf | Partial support – only windows perf data is currently supported. The Linux perf data is missing in export currently. |
897
+
| PFTitleAuditLogs ||
828
898
| PowerBIActivity ||
899
+
| PowerBIAuditTenant ||
900
+
| PowerBIDatasetsTenant ||
829
901
| PowerBIDatasetsWorkspace ||
902
+
| PowerBIReportUsageWorkspace ||
830
903
| ProjectActivity ||
831
904
| PurviewDataSensitivityLogs ||
832
905
| PurviewScanStatusLogs ||
906
+
| PurviewSecurityLogs ||
833
907
| ResourceManagementPublicAccessLogs ||
834
908
| SCCMAssessmentRecommendation ||
835
909
| SCOMAssessmentRecommendation ||
@@ -852,14 +926,18 @@ All data from the table will be exported unless limitations are specified. This
852
926
| SPAssessmentRecommendation ||
853
927
| SQLAssessmentRecommendation ||
854
928
| SQLSecurityAuditEvents ||
929
+
| StorageAntimalwareScanResults ||
855
930
| StorageCacheOperationEvents ||
931
+
| StorageCacheUpgradeEvents ||
932
+
| StorageCacheWarningEvents ||
856
933
| SucceededIngestion ||
857
934
| SynapseBigDataPoolApplicationsEnded ||
858
935
| SynapseBuiltinSqlPoolRequestsEnded ||
859
936
| SynapseGatewayApiRequests ||
860
937
| SynapseIntegrationActivityRuns ||
861
938
| SynapseIntegrationPipelineRuns ||
862
939
| SynapseIntegrationTriggerRuns ||
940
+
| SynapseLinkEvent ||
863
941
| SynapseRbacOperations ||
864
942
| SynapseScopePoolScopeJobsEnded ||
865
943
| SynapseScopePoolScopeJobsStateChange ||
@@ -871,16 +949,18 @@ All data from the table will be exported unless limitations are specified. This
871
949
| Syslog | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
872
950
| ThreatIntelligenceIndicator ||
873
951
| UCClient ||
874
-
| UCClientUpdateStatus ||
875
-
| UCDeviceAlert ||
876
-
| UCServiceUpdateStatus ||
877
-
| UCUpdateAlert ||
952
+
| UCDOAggregatedStatus ||
953
+
| UCDOStatus ||
878
954
| Update | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
879
955
| UpdateRunProgress ||
880
956
| UpdateSummary ||
957
+
| UrlClickEvents ||
881
958
| Usage ||
882
959
| UserAccessAnalytics ||
883
960
| UserPeerAnalytics ||
961
+
| VIAudit ||
962
+
| VIIndexing ||
963
+
| W3CIISLog | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
0 commit comments