Skip to content

Commit a4d3ca3

Browse files
Merge pull request #245527 from v-jbasden/v-jbasden-logs-content-inventory-line-30
Author new guidance on required permissions
2 parents 524476e + 011cc5b commit a4d3ca3

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

articles/azure-monitor/logs/parse-text.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,16 @@ Some log data collected by Azure Monitor will include multiple pieces of informa
1313

1414
This article describes different options for parsing log data in Azure Monitor when the data is ingested and when it's retrieved in a query, comparing the relative advantages for each.
1515

16+
## Permissions required
17+
18+
- To parse data at collection time, you need `Microsoft.Insights/dataCollectionRuleAssociations/*` permissions, as provided by the [Log Analytics Contributor built-in role](./manage-access.md#log-analytics-contributor), for example.
19+
- To parse data at query time, you need `Microsoft.OperationalInsights/workspaces/query/*/read` permissions, as provided by the [Log Analytics Reader built-in role](./manage-access.md#log-analytics-reader), for example.
20+
1621
## Parsing methods
1722
You can parse data either at ingestion time when the data is collected or at query time when you analyze the data with a query. Each strategy has unique advantages.
1823

1924
### Parse data at collection time
20-
When you parse data at collection time, you configure [custom fields](../logs/custom-fields.md) that create new properties in the table. Queries don't have to include any parsing logic and use these properties as any other field in the table.
25+
Use [transformations](../essentials/data-collection-transformations.md) to parse data at collection time and define which columns to send the parsed data to.
2126

2227
**Advantages:**
2328

@@ -28,7 +33,6 @@ When you parse data at collection time, you configure [custom fields](../logs/cu
2833

2934
- Must be defined in advance. Can't include data that's already been collected.
3035
- If you change the parsing logic, it will only apply to new data.
31-
- Fewer parsing options than available in queries.
3236
- Increases latency time for collecting data.
3337
- Errors can be difficult to handle.
3438

@@ -48,7 +52,7 @@ When you parse data at query time, you include logic in your query to parse data
4852
- Can create overhead when you run complex logic against very large record sets (billions of records).
4953

5054
## Parse data as it's collected
51-
For more information on parsing data as it's collected, see [Create custom fields in Azure Monitor](../logs/custom-fields.md). This approach creates custom properties in the table that can be used by queries like any other property.
55+
For more information on parsing data as it's collected, see [Structure of transformation in Azure Monitor](../essentials/data-collection-transformations-structure.md). This approach creates custom properties in the table that can be used by queries like any other property.
5256

5357
## Parse data in a query by using patterns
5458
When the data you want to parse can be identified by a pattern repeated across records, you can use different operators in the [Kusto Query Language](/azure/kusto/query/) to extract the specific piece of data into one or more new properties.

0 commit comments

Comments
 (0)