You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/log-analytics/log-analytics-data-sources-custom-logs.md
+6-12Lines changed: 6 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,21 +39,15 @@ The log files to be collected must match the following criteria.
39
39
## Defining a custom log
40
40
Use the following procedure to define a custom log file. Scroll to the end of this article for a walkthrough of a sample of adding a custom log.
41
41
42
-
### Step 1. Enable Custom Logs preview
43
-
1. In the Azure portal, click **All services**. In the list of resources, type **Log Analytics**. As you begin typing, the list filters based on your input. Select **Log Analytics**.
44
-
2. In the Log Analytics subscriptions pane, select a workspace and then select the **OMS Portal** tile.<br><br> <br><br>
45
-
3. After you are redirected to the OMS portal, click the Settings tile on the top right-hand side of the page.<br><br> <br><br>
46
-
4. From the **Settings** page, select **Preview Features** and on the page, select **Enable** for Custom Logs.
47
-
48
-
### Step 2. Open the Custom Log Wizard
42
+
### Step 1. Open the Custom Log Wizard
49
43
The Custom Log Wizard runs in the Azure portal and allows you to define a new custom log to collect.
50
44
51
45
1. In the Azure portal, select **Log Analytics** > your workspace > **Advanced Settings**.
52
46
2. Click on **Data** > **Custom logs**.
53
47
3. By default, all configuration changes are automatically pushed to all agents. For Linux agents, a configuration file is sent to the Fluentd data collector. If you wish to modify this file manually on each Linux agent, then uncheck the box *Apply below configuration to my Linux machines*.
54
48
4. Click **Add+** to open the Custom Log Wizard.
55
49
56
-
### Step 3. Upload and parse a sample log
50
+
### Step 2. Upload and parse a sample log
57
51
You start by uploading a sample of the custom log. The wizard will parse and display the entries in this file for you to validate. Log Analytics will use the delimiter that you specify to identify each record.
58
52
59
53
**New Line** is the default delimiter and is used for log files that have a single entry per line. If the line starts with a date and time in one of the available formats, then you can specify a **Timestamp** delimiter which supports entries that span more than one line.
@@ -67,7 +61,7 @@ If a timestamp delimiter is used, then the TimeGenerated property of each record
67
61
4. Change the delimiter that is used to identify a new record and select the delimiter that best identifies the records in your log file.
68
62
5. Click **Next**.
69
63
70
-
### Step 4. Add log collection paths
64
+
### Step 3. Add log collection paths
71
65
You must define one or more paths on the agent where it can locate the custom log. You can either provide a specific path and name for the log file, or you can specify a path with a wildcard for the name. This supports applications that create a new file each day or when one file reaches a certain size. You can also provide multiple paths for a single log file.
72
66
73
67
For example, an application might create a log file each day with the date included in the name as in log20100316.txt. A pattern for such a log might be *log\*.txt* which would apply to any log file following the application’s naming scheme.
@@ -85,14 +79,14 @@ The following table provides examples of valid patterns to specify different log
85
79
2. Type in the path and click the **+** button.
86
80
3. Repeat the process for any additional paths.
87
81
88
-
### Step 5. Provide a name and description for the log
82
+
### Step 4. Provide a name and description for the log
89
83
The name that you specify will be used for the log type as described above. It will always end with _CL to distinguish it as a custom log.
90
84
91
85
1. Type in a name for the log. The **\_CL** suffix is automatically provided.
92
86
2. Add an optional **Description**.
93
87
3. Click **Next** to save the custom log definition.
94
88
95
-
### Step 6. Validate that the custom logs are being collected
89
+
### Step 5. Validate that the custom logs are being collected
96
90
It may take up to an hour for the initial data from a new custom log to appear in Log Analytics. It will start collecting entries from the logs found in the path you specified from the point that you defined the custom log. It will not retain the entries that you uploaded during the custom log creation, but it will collect already existing entries in the log files that it locates.
97
91
98
92
Once Log Analytics starts collecting from the custom log, its records will be available with a Log Search. Use the name that you gave the custom log as the **Type** in your query.
@@ -102,7 +96,7 @@ Once Log Analytics starts collecting from the custom log, its records will be av
102
96
>
103
97
>
104
98
105
-
### Step 7. Parse the custom log entries
99
+
### Step 6. Parse the custom log entries
106
100
The entire log entry will be stored in a single property called **RawData**. You will most likely want to separate the different pieces of information in each entry into individual properties stored in the record. You do this using the [Custom Fields](log-analytics-custom-fields.md) feature of Log Analytics.
107
101
108
102
Detailed steps for parsing the custom log entry are not provided here. Please refer to the [Custom Fields](log-analytics-custom-fields.md) documentation for this information.
0 commit comments