You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/essentials/data-collection-rule-create-edit.md
+29-26Lines changed: 29 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,11 +10,13 @@ ms.custom: references_regions
10
10
---
11
11
12
12
# Create and edit data collection rules (DCRs) in Azure Monitor
13
+
13
14
There are multiple methods for creating a [data collection rule (DCR)](./data-collection-rule-overview.md) in Azure Monitor. In some cases, Azure Monitor will create and manage the DCR according to settings that you configure in the Azure portal. In other cases, you might need to create your own DCRs to customize particular scenarios.
14
15
15
16
This article describes the different methods for creating and editing a DCR. For the contents of the DCR itself, see [Structure of a data collection rule in Azure Monitor](./data-collection-rule-structure.md).
16
17
17
18
## Permissions
19
+
18
20
You require the following permissions to create DCRs and associations:
19
21
20
22
| Built-in role | Scopes | Reason |
@@ -24,6 +26,7 @@ This article describes the different methods for creating and editing a DCR. For
24
26
| Any role that includes the action *Microsoft.Resources/deployments/**| <ul><li>Subscription and/or</li><li>Resource group and/or </li><li>An existing DCR</li></ul> | Deploy Azure Resource Manager templates. |
25
27
26
28
## Automated methods to create a DCR
29
+
27
30
The following table lists methods to create data collection scenarios using the Azure portal where the DCR is created for you. In these cases you don't need to interact directly with the DCR itself.
28
31
29
32
| Scenario | Resources | Description |
@@ -32,7 +35,6 @@ The following table lists methods to create data collection scenarios using the
32
35
| Container insights |[Enable Container insights](../containers/kubernetes-monitoring-enable.md#enable-prometheus-and-grafana)| When you enable Container insights on a Kubernetes cluster, a containerized version of the Azure Monitor agent is installed, and a DCR is created that collects data according to the configuration you selected. You may need to modify this DCR to add a transformation. |
33
36
| Workspace transformation |[Add a transformation in a workspace data collection rule using the Azure portal](../logs/tutorial-workspace-transformations-portal.md)| Create a transformation for any supported table in a Log Analytics workspace. The transformation is defined in a DCR that's then associated with the workspace. It's applied to any data sent to that table from a legacy workload that doesn't already use a DCR. |
34
37
35
-
36
38
## Create a DCR
37
39
38
40
Azure provides a centralized cloud based data collection configuration plan for virtual machines, virtual machine scale sets, On-Prem machines and Prometheus metrics from containers.
@@ -47,7 +49,7 @@ To create a data collection rule using the Azure CLI, PowerShell, API, or ARM te
47
49
## [Portal](#tab/portal)
48
50
49
51
On the **Monitor** menu, select **Data Collection Rules** > **Create** to open the page to create a new data collection rule.
50
-
52
+
51
53
:::image type="content" source="media/data-collection-rule-create-edit/data-collection-rules-updated.png" lightbox="media/data-collection-rule-create-edit/data-collection-rules-updated.png" alt-text="Screenshot that shows the Create button on the Data Collection Rules screen." border="false":::
52
54
53
55
Configure the settings in each step of the wizard, as detailed below.
@@ -71,9 +73,9 @@ Configure the settings in each step of the wizard, as detailed below.
71
73
72
74
| Screen element | Description |
73
75
|:---|:---|
74
-
|**+ Add resources**| Associate virtual machines, Virtual Machine Scale Sets, and Azure Arc for servers to the data collection rule. The Azure portal installs Azure Monitor Agent on resources that don't already have the agent installed.|
75
-
|**Enable Data Collection Endpoints**| If the machine you're monitoring is not in the same region as your destination Log Analytics workspace, enable data collection endpoints and select an endpoint in the region of the monitored machine to collect **Linux syslog data**, **IIS logs**, **custom text logs** or **custom JSON logs**.<br>If the monitored machine is in the same region as your destination Log Analytics workspace, or if you're collecting performance counters and Windows event logs, don't select a data collection endpoint on the **Resources** tab.<br>The data collection endpoint on the **Resources** tab is the configuration access endpoint, as described in [Components of a data collection endpoint](../essentials/data-collection-endpoint-overview.md#components-of-a-dce).<br>If you need network isolation using private links, select existing endpoints from the same region for the respective resources or [create a new endpoint](../essentials/data-collection-endpoint-overview.md).|
76
-
|**Agent extension identity**| Use a system-assigned managed identity, or select an existing user-assigned identity assigned to the virtual machine. For more information, see [Managed identity types](/entra/identity/managed-identities-azure-resources/overview#managed-identity-types).|
76
+
|**+ Add resources**| Associate virtual machines, Virtual Machine Scale Sets, and Azure Arc for servers to the data collection rule. The Azure portal installs Azure Monitor Agent on resources that don't already have the agent installed.|
77
+
|**Enable Data Collection Endpoints**| If the machine you're monitoring is not in the same region as your destination Log Analytics workspace, enable data collection endpoints and select an endpoint in the region of the monitored machine to collect **Linux syslog data**, **IIS logs**, **custom text logs** or **custom JSON logs**.<br>If the monitored machine is in the same region as your destination Log Analytics workspace, or if you're collecting performance counters and Windows event logs, don't select a data collection endpoint on the **Resources** tab.<br>The data collection endpoint on the **Resources** tab is the configuration access endpoint, as described in [Components of a data collection endpoint](../essentials/data-collection-endpoint-overview.md#components-of-a-dce).<br>If you need network isolation using private links, select existing endpoints from the same region for the respective resources or [create a new endpoint](../essentials/data-collection-endpoint-overview.md).|
78
+
|**Agent extension identity**| Use a system-assigned managed identity, or select an existing user-assigned identity assigned to the virtual machine. For more information, see [Managed identity types](/entra/identity/managed-identities-azure-resources/overview#managed-identity-types).|
77
79
78
80
### Collect and deliver
79
81
@@ -83,8 +85,8 @@ On the **Collect and deliver** tab, select **Add data source** and configure the
83
85
84
86
| Screen element | Description |
85
87
|:---|:---|
86
-
|**Data source**| Select a **Data source type** and define related fields based on the data source type you select. For more information about collecting data from the various data source types, see [Collect data with Azure Monitor Agent](../agents/azure-monitor-agent-data-collection.md)|
87
-
|**Destination**| Add one or more destinations for each source. You can select multiple destinations of the same or different types. |
88
+
|**Data source**| Select a **Data source type** and define related fields based on the data source type you select. For more information about collecting data from the various data source types, see [Collect data with Azure Monitor Agent](../agents/azure-monitor-agent-data-collection.md)|
89
+
|**Destination**| Add one or more destinations for each source. You can select multiple destinations of the same or different types. |
Use the [New-AzDataCollectionRule](/powershell/module/az.monitor/new-azdatacollectionrule) cmdlet to create the DCR from your JSON file using PowerShell as shown in the following example.
105
107
106
108
```powershell
107
-
New-AzDataCollectionRule -Location 'east-us' -ResourceGroupName 'my-resource-group' -RuleName 'myDCRName' -RuleFile 'C:\MyNewDCR.json' -Description 'This is my new DCR'
| Get associations |[Get-AzDataCollectionRuleAssociation](/powershell/module/az.monitor/get-azdatacollectionruleassociation)|
127
+
| Create an association |[New-AzDataCollectionRuleAssociation](/powershell/module/az.monitor/new-azdatacollectionruleassociation)|
126
128
| Delete an association |[Remove-AzDataCollectionRuleAssociation](/powershell/module/az.monitor/remove-azdatacollectionruleassociation)|
127
129
128
130
### [API](#tab/api)
129
-
Use the [DCR create API](/rest/api/monitor/data-collection-rules/create) to create the DCR from your JSON file. You can use any method to call a REST API as shown in the following examples.
130
131
132
+
Use the [DCR create API](/rest/api/monitor/data-collection-rules/create) to create the DCR from your JSON file. You can use any method to call a REST API as shown in the following examples.
Use the following template to create a DCR using information from [Structure of a data collection rule in Azure Monitor](./data-collection-rule-structure.md) and [Sample data collection rules (DCRs) in Azure Monitor](./data-collection-rule-samples.md) to define the `dcr-properties`.
154
154
@@ -186,6 +186,7 @@ Use the following template to create a DCR using information from [Structure of
186
186
```
187
187
188
188
#### DCR Association -Azure VM
189
+
189
190
The following sample creates an association between an Azure virtual machine and a data collection rule.
190
191
191
192
**Bicep template file**
@@ -274,7 +275,9 @@ resource association 'Microsoft.Insights/dataCollectionRuleAssociations@2021-09-
274
275
}
275
276
}
276
277
```
278
+
277
279
### DCR Association -Arc-enabled server
280
+
278
281
The following sample creates an association between an Azure Arc-enabled server and a data collection rule.
279
282
280
283
**Bicep template file**
@@ -365,8 +368,8 @@ resource association 'Microsoft.Insights/dataCollectionRuleAssociations@2021-09-
365
368
```
366
369
---
367
370
368
-
369
371
## Edit a DCR
372
+
370
373
To edit a DCR, you can use any of the methods described in the previous section to create a DCR using a modified version of the JSON.
371
374
372
375
If you need to retrieve the JSON for an existing DCR, you can copy it from the **JSON View** for the DCR in the Azure portal. You can also retrieve it using an API call as shown in the following PowerShell example.
@@ -382,5 +385,5 @@ For a tutorial that walks through the process of retrieving and then editing an
382
385
383
386
## Next steps
384
387
385
-
-[Read about the detailed structure of a data collection rule](data-collection-rule-structure.md)
386
-
-[Get details on transformations in a data collection rule](data-collection-transformations.md)
388
+
*[Read about the detailed structure of a data collection rule](data-collection-rule-structure.md)
389
+
*[Get details on transformations in a data collection rule](data-collection-transformations.md)
0 commit comments