You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/custom-fields-migrate.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,7 +44,7 @@ Start by locating custom fields to replace. If you already know the custom field
44
44
45
45
1. Note if any data collection rules (DCRs) are associated with given table.
46
46
47
-
- If any DCRs are present in corresponding section, it means that any pre-existing custom fields were either already implemented within these DCRs, or abandoned upon DCR creation. We are going to examine the content of custom fields on the next step of this tutorial and determine whether more updates to DCRs needed.
47
+
- If any DCRs are present in corresponding section, it means that any pre-existing custom fields were either already implemented within these DCRs, or abandoned upon DCR creation. You're going to examine the content of custom fields on the next step of this tutorial and determine whether more updates to DCRs needed.
48
48
- If there are no data collection rules associated with the table, then all columns in given table with names ending with "_CF" will be custom fields subject to replacement.
49
49
50
50
:::image type="content" source="media/custom-fields-migrate/manage-table-details.png" alt-text="Screenshot showing the properties of a table including data collection rules associated with the table" lightbox="media/custom-fields-migrate/manage-table-details.png":::
@@ -53,9 +53,9 @@ Start by locating custom fields to replace. If you already know the custom field
53
53
54
54
:::image type="content" source="media/custom-fields-migrate/custom-columns.png" alt-text="Screenshot showing the column listing for a table including any custom columns" lightbox="media/custom-fields-migrate/custom-columns.png":::
55
55
56
-
1. Note the names of these columns as we are going to determine their content on the next step.
56
+
1. Note the names of these columns since you'll determine their content in the next step.
57
57
58
-
## Understanding custom field content
58
+
## Understand custom field content
59
59
Since there is no way to examine the custom field definition directly, you need to query the table to determine the custom field formula.
60
60
61
61
1. Select **Logs** in the side menu and run a query to get a sample of data from the table.
@@ -74,15 +74,15 @@ You're now ready to create the required KQL snippet and add it to a DCR. This lo
74
74
75
75
1. Modify the query for the table using KQL to replicate the custom field logic. If you have multiple custom fields to replace, you may combine their calculation logic into a single statement.
76
76
77
-
- Use [parse](/azure/data-explorer/kusto/query/parseoperator.md) operator for pattern-based search of a substring within a string.
77
+
- Use [parse](/azure/data-explorer/kusto/query/parseoperator) operator for pattern-based search of a substring within a string.
78
78
- Use [extract()](/azure/data-explorer/kusto/query/extractfunction) function for regex-based substring search.
79
79
- String functions as [split()](/azure/data-explorer/kusto/query/splitfunction), [substring()](/azure/data-explorer/kusto/query/substringfunction) and [many others](/azure/data-explorer/kusto/query/scalarfunctions#string-functions) may also be useful.
80
80
81
81
:::image type="content" source="media/custom-fields-migrate/log-analytics-transformation-query.png" alt-text="Screenshot of Log Analytics with query returning data using transformation query" lightbox="media/custom-fields-migrate/log-analytics-transformation-query.png":::
82
82
83
83
2. Determine where your new KQL definition of the custom column needs to be placed.
84
84
85
-
- For logs collected using [Azure Monitor Agent (AMA)](../../agents/agents-overview.md), [edit the DCR](../../essentials/data-collection-rule-edit.md) collecting data for the table, adding a transformation. For an example, see [Samples](../essentials/data-collection-transformations.md#samples). The transformation query is defined in the `transformKql` element.
85
+
- For logs collected using [Azure Monitor Agent (AMA)](../agents/agents-overview.md), [edit the DCR](../essentials/data-collection-rule-edit.md) collecting data for the table, adding a transformation. For an example, see [Samples](../essentials/data-collection-transformations.md#samples). The transformation query is defined in the `transformKql` element.
86
86
- For resource logs collected with [diagnostic settings](../essentials/diagnostic-settings.md), add the transformation to the [workspace default DCR](../essentials/data-collection-transformations.md#workspace-transformation-dcr). The table must [support transformations](../logs/tables-feature-support.md).
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/custom-fields.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.date: 03/31/2023
12
12
# Create custom fields in a Log Analytics workspace in Azure Monitor (Preview)
13
13
14
14
> [!NOTE]
15
-
> Creation of new custom fields will be disabled starting March 31st, 2023. Custom fields functionality will be deprecated, and existing custom fields will stop functioning by March 31st, 2026. You should [migrate to ingestion-time transformations](custom-fields-migrate.md) to keep parsing your log records.
15
+
> Creation of new custom fields will be disabled starting March 31, 2023. Custom fields functionality will be deprecated, and existing custom fields will stop functioning by March 31, 2026. You should [migrate to ingestion-time transformations](custom-fields-migrate.md) to keep parsing your log records.
16
16
17
17
> [!IMPORTANT]
18
18
> Custom fields increases the amount of data collected in the Log Analytics workspace which can increase your cost. See [Azure Monitor Logs pricing details](cost-logs.md) for details.
0 commit comments