Restructure to focus on category of data

Author: rcdun

articles/operator-insights/monitor-operator-insights-data-reference.md

@@ -26,9 +26,9 @@ This section lists the types of resource logs you can collect for Azure Operator
 
 |Resource Log Type | Resource Provider / Type Namespace<br/> and link to individual logs |
 |-------|-----|
-| DataProducts| [Microsoft.NetworkAnalytics/DataProducts](/azure/azure-monitor/platform/resource-logs-categories#microsoftnetworkanalyticsdataproducts) |
+| DataProducts| [Microsoft.NetworkAnalytics/DataProducts](/azure/azure-monitor/reference/supported-logs/microsoft-networkanalytics-dataproducts-logs) |
 
-The DataProducts logs include information about:
+The DataProducts logs have information about:
 
 - `Ingestion` (for adding or changing data in the input storage account for a Data Product)
 - `IngestionDelete` (for deleting data from the input storage account for a Data Product)

articles/operator-insights/monitor-operator-insights.md

@@ -17,48 +17,44 @@ Template for the main monitoring article for Azure services. -->
 
 When you have critical applications and business processes relying on Azure resources, you want to monitor those resources for their availability, performance, and operation. 
 
-This article describes the monitoring data generated by Azure Operator Insights. Azure Operator Insights uses [Azure Monitor](/azure/azure-monitor/overview) for Data Products and other monitoring data for ingestion agents.
+Azure Operator Insights Data Products use [Azure Monitor](/azure/azure-monitor/overview). They collect the same kinds of monitoring data as other Azure resources that are described in [Monitoring data from Azure resources](/azure/azure-monitor/essentials/monitor-azure-resource#monitoring-data-from-Azure-resources). See [Monitoring Azure Operator Insights data reference](monitor-operator-insights-data-reference.md) for detailed information on the monitoring data created by Data Products.
 
-If you're unfamiliar with the features of Azure Monitor common to all Azure services that use it, read [Monitoring Azure resources with Azure Monitor](/azure/azure-monitor/essentials/monitor-azure-resource).
+> [!TIP]
+> If you're unfamiliar with the features of Azure Monitor common to all Azure services that use it, read [Monitoring Azure resources with Azure Monitor](/azure/azure-monitor/essentials/monitor-azure-resource).
 
-## Monitoring data 
+Ingestion agents also collect monitoring data that you or Microsoft Support can use for troubleshooting.
 
-Data Products for Azure Operator Insights collect the same kinds of monitoring data as other Azure resources that are described in [Monitoring data from Azure resources](/azure/azure-monitor/essentials/monitor-azure-resource#monitoring-data-from-Azure-resources). See [Monitoring Azure Operator Insights data reference](monitor-operator-insights-data-reference.md) for detailed information on the monitoring data created by Data Products.
+## Metrics for Data Products: overview, collection and analysis
 
-Azure Operator Insights also requires ingestion agents deployed in your network. Ingestion agents that we provide collect metrics and logs for troubleshooting.
+Azure Operator Insights doesn't provide metrics in Azure Monitor.
 
-## Collection and routing
+## Activity logs for Data Products: overview, collection and analysis
 
-For Data Products:
+The [Activity log](/azure/azure-monitor/essentials/activity-log) is a type of platform log in Azure that provides insight into subscription-level events. For Azure Operator Insights, the Activity log includes activities like creating a Data Product or changing its settings.
 
-- Platform metrics and the Activity log are collected and stored automatically by Azure, but can be routed to other locations by using a diagnostic setting.
-- Resource Logs aren't collected and stored until you create a diagnostic setting and route them to one or more locations.
+The Activity log is collected and stored automatically by Azure. You can:
 
-See [Create diagnostic setting to collect platform logs and metrics in Azure](/azure/azure-monitor/platform/diagnostic-settings) for the detailed process for creating a diagnostic setting using the Azure portal, CLI, or PowerShell. When you create a diagnostic setting, you specify which categories of logs to collect. The categories for Azure Operator Insights are listed in [Azure Operator Insights monitoring data reference](monitor-operator-insights-data-reference.md#resource-logs).
+- View the Activity log in the **Activity Log** for your Data Product.
+- Route the Activity Log to Azure Monitor Logs, where you can do much more complex queries using Log Analytics. See [Send to Log Analytics workspace](../azure-monitor/essentials/activity-log.md#send-to-log-analytics-workspace).
+- Route the Activity Log to other location or download it. See [Azure Monitor activity log](../azure-monitor/essentials/activity-log.md).
 
-The Azure Monitor metrics and logs for Data Products are discussed in the following sections.
+## Resource logs for Data Products: overview, collection and analysis
 
-Ingestion agents that we provide automatically collect metrics and logs for troubleshooting. Metrics and logs are stored on the VM on which you have installed the agent, and aren't uploaded to Azure Monitor. For details, see the troubleshooting guidance for [MCC EDR Ingestion Agents](troubleshoot-mcc-edr-agent.md) or [SFTP Ingestion Agents](troubleshoot-sftp-agent.md).
+Resource logs provide an insight into operations that were performed within an Azure resource. This is know as the *data plane*. For Data Products, resource logs include ingestion (activity on files uploaded to Azure Operator Insights), digestion (processing the data in those files), and management of the processed data. 
 
-## Analyzing metrics
+For a full list of the types of resource logs collected for Azure Operator Insights, see [Monitoring Azure Operator Insights data reference: Resource logs](monitor-operator-insights-data-reference.md#resource-logs).
 
-Azure Operator Insights doesn't provide metrics in Azure Monitor.
+Resource logs aren't collected and stored until you create a *diagnostic setting* and route them to one or more locations. We recommend routing them to a Log Analytics workspace, which stores the logs in [Azure Monitor Logs](../azure-monitor/logs/data-platform-logs.md). Log Analytics allows you to analyze the logs of all your Azure resources together in Azure Monitor Logs and take advantage of all the features available to Azure Monitor Logs including [log queries](../azure-monitor/logs/log-query-overview.md) and [log alerts](../azure-monitor/alerts/alerts-log.md). You can access Log Analytics using the **Logs** from the Azure Operator Insights menu.
 
-## Analyzing logs
+To create a diagnostic setting, see [Create diagnostic setting to collect platform logs and metrics in Azure](/azure/azure-monitor/platform/diagnostic-settings). You can use the Azure portal, CLI, or PowerShell. When you create a diagnostic setting, you specify which categories of logs to collect. The categories for Azure Operator Insights are listed in [Azure Operator Insights monitoring data reference](monitor-operator-insights-data-reference.md#resource-logs).
 
-Data in Azure Monitor Logs is stored in tables where each table has its own set of unique properties.  
+Data in Azure Monitor Logs is stored in tables where each table has its own set of unique properties. For a list of the Azure Operator Insights tables used by Azure Monitor Logs and queryable by Log Analytics, see [Monitoring Azure Operator Insights data reference: Azure Monitor Logs tables](monitor-operator-insights-data-reference.md#azure-monitor-logs-tables). 
 
 All resource logs in Azure Monitor have the same fields followed by service-specific fields. The common schema is outlined in [Azure Monitor resource log schema](/azure/azure-monitor/essentials/resource-logs-schema) The schemas for Azure Operator Insights resource logs are found in the [Azure Operator Insights Data Reference: Schemas](monitor-operator-insights-data-reference.md#schemas).
 
-The [Activity log](/azure/azure-monitor/essentials/activity-log) is a type of platform log in Azure that provides insight into subscription-level events. For Azure Operator Insights, the Activity log includes activities like creating a Data Product or changing its settings. You can view the Activity independently or route it to Azure Monitor Logs, where you can do much more complex queries using Log Analytics.
-
-For a list of the types of resource logs collected for Azure Operator Insights, see [Monitoring Azure Operator Insights data reference: Resource logs](monitor-operator-insights-data-reference.md#resource-logs).
-
-For a list of the tables used by Azure Monitor Logs and queryable by Log Analytics, see [Monitoring Azure Operator Insights data reference: Azure Monitor Logs tables](monitor-operator-insights-data-reference.md#azure-monitor-logs-tables).
-
 ### Sample Kusto queries
 
-You can use the following example queries to help you monitor your Data Products:
+You can use the following example queries in a Log Analytics workspace to help you monitor your Data Products:
 
 - Get all logs about rows that weren't digested successfully:
 
@@ -112,7 +108,13 @@ You can use the following example queries to help you monitor your Data Products
 > [!IMPORTANT]
 > When you select **Logs** from the Azure Operator Insights menu, Log Analytics is opened with the query scope set to the current Data Product. This means that log queries will only include data from that resource. If you want to run a query that includes data from other Data Products or data from other Azure services, select **Logs** from the **Azure Monitor** menu. See [Log query scope and time range in Azure Monitor Log Analytics](/azure/azure-monitor/logs/scope) for details.
 
-For a list of common queries for Azure Operator Insights, see the [Log Analytics queries interface](/azure/azure-monitor/logs/queries). 
+For a list of common queries for Azure Operator Insights, see the [Log Analytics queries interface](/azure/azure-monitor/logs/queries).
+
+## Monitoring for ingestion agents
+
+Azure Operator Insights also requires ingestion agents deployed in your network.
+
+Ingestion agents that we provide automatically collect metrics and logs for troubleshooting. Metrics and logs are stored on the VM on which you have installed the agent, and aren't uploaded to Azure Monitor. For details, see the troubleshooting guidance for [MCC EDR Ingestion Agents](troubleshoot-mcc-edr-agent.md) or [SFTP Ingestion Agents](troubleshoot-sftp-agent.md).
 
 ## Next steps