Skip to content

Commit a6af913

Browse files
yossi-yyossi-y
committed
Applied reviewer comments
1 parent 70d4156 commit a6af913

File tree

1 file changed

+54
-41
lines changed

1 file changed

+54
-41
lines changed

‎articles/azure-monitor/logs/logs-export-logic-app.md

Lines changed: 54 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ The method described in this article describes a scheduled export from a log que
2222
## Overview
2323
This procedure uses the [Azure Monitor Logs connector](/connectors/azuremonitorlogs/) which lets you run a log query from a Logic App and use its output in other actions in the workflow. The [Azure Blob Storage connector](/connectors/azureblob/) is used in this procedure to send the query output to Azure storage.
2424

25-
[![Logic app overview](media/logs-export-logic-app/logic-app-overview.png "Screenshot of Logic app flow")](media/logs-export-logic-app/logic-app-overview.png#lightbox)
25+
[![Logic app overview](media/logs-export-logic-app/logic-app-overview.png "Screenshot of Logic app flow.")](media/logs-export-logic-app/logic-app-overview.png#lightbox)
2626

2727
When you export data from a Log Analytics workspace, you should filter and aggregate your log data and optimize query and limit the amount of data processed by your Logic App workflow, to the required data. For example, if you need to archive sign-in events, you should filter for required events and project only the required fields. For example:
2828

@@ -57,31 +57,35 @@ Log Analytics workspace and log queries in Azure Monitor are multitenancy servic
5757

5858
1. **Create Logic App**
5959

60-
1. Go to **Logic Apps** in the Azure portal and click **Add**. Select a **Subscription**, **Resource group**, and **Region** to store the new Logic App and then give it a unique name. You can turn on **Log Analytics** setting to collect information about runtime data and events as described in [Set up Azure Monitor logs and collect diagnostics data for Azure Logic Apps](../../logic-apps/monitor-logic-apps-log-analytics.md). This setting isn't required for using the Azure Monitor Logs connector.<br>
61-
[![Create Logic App](media/logs-export-logic-app/create-logic-app.png "Screenshot of Logic App resource create")](media/logs-export-logic-app/create-logic-app.png#lightbox)
60+
1. Go to **Logic Apps** in the Azure portal and click **Add**. Select a **Subscription**, **Resource group**, and **Region** to store the new Logic App and then give it a unique name. You can turn on **Log Analytics** setting to collect information about runtime data and events as described in [Set up Azure Monitor logs and collect diagnostics data for Azure Logic Apps](../../logic-apps/monitor-logic-apps-log-analytics.md). This setting isn't required for using the Azure Monitor Logs connector.
61+
\
62+
[![Create Logic App](media/logs-export-logic-app/create-logic-app.png "Screenshot of Logic App resource create.")](media/logs-export-logic-app/create-logic-app.png#lightbox)
6263

63-
1. Click **Review + create** and then **Create**. When the deployment is complete, click **Go to resource** to open the **Logic Apps Designer**.
64+
2. Click **Review + create** and then **Create**. When the deployment is complete, click **Go to resource** to open the **Logic Apps Designer**.
6465

65-
1. **Create a trigger for the Logic App**
66+
2. **Create a trigger for the Logic App**
6667

67-
1. Under **Start with a common trigger**, select **Recurrence**. This creates a Logic App that automatically runs at a regular interval. In the **Frequency** box of the action, select **Day** and in the **Interval** box, enter **1** to run the workflow once per day.<br>
68-
[![Recurrence action](media/logs-export-logic-app/recurrence-action.png "Screenshot of recurrence action create")](media/logs-export-logic-app/recurrence-action.png#lightbox)
68+
1. Under **Start with a common trigger**, select **Recurrence**. This creates a Logic App that automatically runs at a regular interval. In the **Frequency** box of the action, select **Day** and in the **Interval** box, enter **1** to run the workflow once per day.
69+
\
70+
[![Recurrence action](media/logs-export-logic-app/recurrence-action.png "Screenshot of recurrence action create.")](media/logs-export-logic-app/recurrence-action.png#lightbox)
6971

70-
2. **Add Azure Monitor Logs action**
72+
3. **Add Azure Monitor Logs action**
7173

7274
The Azure Monitor Logs action lets you specify the query to run. The log query used in this example is optimized for hourly recurrence and collects the data ingested for the particular execution time. For example, if the workflow runs at 4:35, the time range would be 3:00 to 4:00. If you change the Logic App to run at a different frequency, you need the change the query as well. For example, if you set the recurrence to run daily, you would set startTime in the query to startofday(make_datetime(year,month,day,0,0)).
7375

7476
You will be prompted to select a tenant to grant access to the Log Analytics workspace with the account that the workflow will use to run the query.
7577

76-
1. Click **+ New step** to add an action that runs after the recurrence action. Under **Choose an action**, type **azure monitor** and then select **Azure Monitor Logs**.<br>
77-
[![Azure Monitor Logs action](media/logs-export-logic-app/select-azure-monitor-connector.png "Screenshot of Azure Monitor Logs action create")](media/logs-export-logic-app/select-azure-monitor-connector.png#lightbox)
78+
1. Click **+ New step** to add an action that runs after the recurrence action. Under **Choose an action**, type **azure monitor** and then select **Azure Monitor Logs**.
79+
\
80+
[![Azure Monitor Logs action](media/logs-export-logic-app/select-azure-monitor-connector.png "Screenshot of Azure Monitor Logs action create.")](media/logs-export-logic-app/select-azure-monitor-connector.png#lightbox)
7881

79-
2. Click **Azure Log Analytics – Run query and list results**.<br>
80-
[![Azure Monitor Logs is highlighted under Choose an action.](media/logs-export-logic-app/select-query-action-list.png "Screenshot of a new action being added to a step in the Logic App Designer")](media/logs-export-logic-app/select-query-action-list.png#lightbox)
82+
1. Click **Azure Log Analytics – Run query and list results**.
83+
\
84+
[![Azure Monitor Logs is highlighted under Choose an action.](media/logs-export-logic-app/select-query-action-list.png "Screenshot of a new action being added to a step in the Logic App Designer.")](media/logs-export-logic-app/select-query-action-list.png#lightbox)
8185

82-
3. Select the **Subscription** and **Resource Group** for your Log Analytics workspace. Select *Log Analytics Workspace* for the **Resource Type** and then select the workspace's name under **Resource Name**.
86+
2. Select the **Subscription** and **Resource Group** for your Log Analytics workspace. Select *Log Analytics Workspace* for the **Resource Type** and then select the workspace's name under **Resource Name**.
8387

84-
4. Add the following log query to the **Query** window.
88+
3. Add the following log query to the **Query** window.
8589

8690
```Kusto
8791
let dt = now();
@@ -108,10 +112,11 @@ Log Analytics workspace and log queries in Azure Monitor are multitenancy servic
108112
ResourceId = _ResourceId
109113
```
110114
111-
5. The **Time Range** specifies the records that will be included in the query based on the **TimeGenerated** column. This should be set to a value greater than the time range selected in the query. Since this query isn't using the **TimeGenerated** column, then **Set in query** option isn't available. See [Query scope](./scope.md) for more details about the time range. Select **Last 4 hours** for the **Time Range**. This will ensure that any records with an ingestion time larger than **TimeGenerated** will be included in the results.<br>
112-
[![Screenshot of the settings for the new Azure Monitor Logs action named Run query and visualize results.](media/logs-export-logic-app/run-query-list-action.png "of the settings for the new Azure Monitor Logs action named Run query and visualize results")](media/logs-export-logic-app/run-query-list-action.png#lightbox)
115+
4. The **Time Range** specifies the records that will be included in the query based on the **TimeGenerated** column. This should be set to a value greater than the time range selected in the query. Since this query isn't using the **TimeGenerated** column, then **Set in query** option isn't available. See [Query scope](./scope.md) for more details about the time range. Select **Last 4 hours** for the **Time Range**. This will ensure that any records with an ingestion time larger than **TimeGenerated** will be included in the results.
116+
\
117+
[![Screenshot of the settings for the new Azure Monitor Logs action named Run query and visualize results.](media/logs-export-logic-app/run-query-list-action.png "of the settings for the new Azure Monitor Logs action named Run query and visualize results.")](media/logs-export-logic-app/run-query-list-action.png#lightbox)
113118
114-
3. **Add Parse JSON activity (optional)**
119+
4. **Add Parse JSON activity (optional)**
115120
116121
The output from the **Run query and list results** action is formatted in JSON. You can parse this data and manipulate it as part of the preparation for **Compose** action.
117122
@@ -136,55 +141,63 @@ Log Analytics workspace and log queries in Azure Monitor are multitenancy servic
136141
}
137142
```
138143
139-
1. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **json** and then select **Parse JSON**.<br>
140-
[![Select Parse JSON operator](media/logs-export-logic-app/select-parse-json.png "Screenshot of Parse JSON operator")](media/logs-export-logic-app/select-parse-json.png#lightbox)
144+
1. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **json** and then select **Parse JSON**.
145+
\
146+
[![Select Parse JSON operator](media/logs-export-logic-app/select-parse-json.png "Screenshot of Parse JSON operator.")](media/logs-export-logic-app/select-parse-json.png#lightbox)
141147
142-
1. Click in the **Content** box to display a list of values from previous activities. Select **Body** from the **Run query and list results** action. This is the output from the log query.<br>
143-
[![Select Body](media/logs-export-logic-app/select-body.png "Screenshot of Par JSON Content setting with output Body from previous step")](media/logs-export-logic-app/select-body.png#lightbox)
148+
1. Click in the **Content** box to display a list of values from previous activities. Select **Body** from the **Run query and list results** action. This is the output from the log query.
149+
\
150+
[![Select Body](media/logs-export-logic-app/select-body.png "Screenshot of Par JSON Content setting with output Body from previous step.")](media/logs-export-logic-app/select-body.png#lightbox)
144151
145152
1. Copy the sample record saved earlier, click **Use sample payload to generate schema** and paste.
153+
\
154+
[![Parse JSON payload](media/logs-export-logic-app/parse-json-payload.png "Screenshot of Parse JSON schema.")](media/logs-export-logic-app/parse-json-payload.png#lightbox)
146155
147-
[![Parse JSON payload](media/logs-export-logic-app/parse-json-payload.png "Screenshot of Parse JSON schema")](media/logs-export-logic-app/parse-json-payload.png#lightbox)
148-
149-
4. **Add the Compose action**
156+
5. **Add the Compose action**
150157
151158
The **Compose** action takes the parsed JSON output and creates the object that you need to store in the blob.
152159
153-
1. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **compose** and then select the **Compose** action.<br>
154-
[![Select Compose action](media/logs-export-logic-app/select-compose.png "Screenshot of Compose action")](media/logs-export-logic-app/select-compose.png#lightbox)
160+
1. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **compose** and then select the **Compose** action.
161+
\
162+
[![Select Compose action](media/logs-export-logic-app/select-compose.png "Screenshot of Compose action.")](media/logs-export-logic-app/select-compose.png#lightbox)
155163
156-
1. Click the **Inputs** box display a list of values from previous activities. Select **Body** from the **Parse JSON** action. This is the parsed output from the log query.<br>
157-
[![Select body for Compose action](media/logs-export-logic-app/select-body-compose.png "Screenshot of body for Compose action")](media/logs-export-logic-app/select-body-compose.png#lightbox)
164+
1. Click the **Inputs** box display a list of values from previous activities. Select **Body** from the **Parse JSON** action. This is the parsed output from the log query.
165+
\
166+
[![Select body for Compose action](media/logs-export-logic-app/select-body-compose.png "Screenshot of body for Compose action.")](media/logs-export-logic-app/select-body-compose.png#lightbox)
158167
159-
5. **Add the Create Blob action**
168+
6. **Add the Create Blob action**
160169
161170
The Create Blob action writes the composed JSON to storage.
162171
163-
1. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **blob** and then select the **Create Blob** action.<br>
164-
[![Select Create blob](media/logs-export-logic-app/select-create-blob.png "Screenshot of blob storage action create")](media/logs-export-logic-app/select-create-blob.png#lightbox)
172+
1. Click **+ New step**, and then click **+ Add an action**. Under **Choose an action**, type **blob** and then select the **Create Blob** action.
173+
\
174+
[![Select Create blob](media/logs-export-logic-app/select-create-blob.png "Screenshot of blob storage action create.")](media/logs-export-logic-app/select-create-blob.png#lightbox)
165175
166176
1. Type a name for the connection to your Storage Account in **Connection Name** and then click the folder icon in the **Folder path** box to select the container in your Storage Account. Click the **Blob name** to see a list of values from previous activities. Click **Expression** and enter an expression that matches your time interval. For this query which is run hourly, the following expression sets the blob name per previous hour:
167177
168178
```json
169179
subtractFromTime(formatDateTime(utcNow(),'yyyy-MM-ddTHH:00:00'), 1,'Hour')
170180
```
181+
\
182+
[![Blob expression](media/logs-export-logic-app/blob-expression.png "Screenshot of blob action connection.")](media/logs-export-logic-app/blob-expression.png#lightbox)
171183
172-
[![Blob expression](media/logs-export-logic-app/blob-expression.png "Screenshot of blob action connection")](media/logs-export-logic-app/blob-expression.png#lightbox)
173-
174-
2. Click the **Blob content** box to display a list of values from previous activities and then select **Outputs** in the **Compose** section.<br>
175-
[![Create blob expression](media/logs-export-logic-app/create-blob.png "Screenshot of blob action output configuration")](media/logs-export-logic-app/create-blob.png#lightbox)
184+
2. Click the **Blob content** box to display a list of values from previous activities and then select **Outputs** in the **Compose** section.
185+
\
186+
[![Create blob expression](media/logs-export-logic-app/create-blob.png "Screenshot of blob action output configuration.")](media/logs-export-logic-app/create-blob.png#lightbox)
176187
177188
178-
6. **Test the Logic App**
189+
7. **Test the Logic App**
179190
180-
Test the workflow by clicking **Run**. If the workflow has errors, it will be indicated on the step with the problem. You can view the executions and drill in to each step to view the input and output to investigate failures. See [Troubleshoot and diagnose workflow failures in Azure Logic Apps](../../logic-apps/logic-apps-diagnosing-failures.md) if necessary.<br>
181-
[![Runs history](media/logs-export-logic-app/runs-history.png "Screenshot of trigger run history")](media/logs-export-logic-app/runs-history.png#lightbox)
191+
Test the workflow by clicking **Run**. If the workflow has errors, it will be indicated on the step with the problem. You can view the executions and drill in to each step to view the input and output to investigate failures. See [Troubleshoot and diagnose workflow failures in Azure Logic Apps](../../logic-apps/logic-apps-diagnosing-failures.md) if necessary.
192+
\
193+
[![Runs history](media/logs-export-logic-app/runs-history.png "Screenshot of trigger run history.")](media/logs-export-logic-app/runs-history.png#lightbox)
182194
183195
184-
7. **View logs in Storage**
196+
8. **View logs in Storage**
185197
186-
Go to the **Storage accounts** menu in the Azure portal and select your Storage Account. Click the **Blobs** tile and select the container you specified in the Create blob action. Select one of the blobs and then **Edit blob**.<br>
187-
[![Blob data](media/logs-export-logic-app/blob-data.png "Screenshot of sample data exported to blob")](media/logs-export-logic-app/blob-data.png#lightbox)
198+
Go to the **Storage accounts** menu in the Azure portal and select your Storage Account. Click the **Blobs** tile and select the container you specified in the Create blob action. Select one of the blobs and then **Edit blob**.
199+
\
200+
[![Blob data](media/logs-export-logic-app/blob-data.png "Screenshot of sample data exported to blob.")](media/logs-export-logic-app/blob-data.png#lightbox)
188201
189202
## Next steps
190203

0 commit comments

Comments
 (0)