links to other articles

Author: bwren

articles/azure-monitor/essentials/data-collection-monitor.md

@@ -41,9 +41,7 @@ Some log ingestion errors will not be logged because they can't be associated wi
 - Certain internal server errors (HTTP response code 500)
 
 ### Enable DCR error logs
-DCR error logs are implemented as [resource logs](./resource-logs.md) in Azure Monitor. Enable log collection by creating a [diagnostic setting](./diagnostic-settings.md) for the DCR. Each DCR will require its own diagnostic setting.
-
-See [Create diagnostic settings in Azure Monitor](./create-diagnostic-settings.md) for the detailed process. Select **Send to Log Analytics workspace** as the destination and select a workspace. You may want to select the same workspace that's used by the DCR, or you may want to consolidate all of your error logs in a single workspace.
+DCR error logs are implemented as [resource logs](./resource-logs.md) in Azure Monitor. Enable log collection by creating a [diagnostic setting](./diagnostic-settings.md) for the DCR. Each DCR will require its own diagnostic setting. See [Create diagnostic settings in Azure Monitor](./create-diagnostic-settings.md) for the detailed process. Select the category **Log Errors** and **Send to Log Analytics workspace**. You may want to select the same workspace that's used by the DCR, or you may want to consolidate all of your error logs in a single workspace.
 
 ### Retrieve DCR error logs
 Error logs are written to the [DCRLogErrors](/azure/azure-monitor/reference/tables/dcrlogerrors) table in the Log Analytics workspace you specified in the diagnostic setting. Following are sample queries you can use in [Log Analytics](../logs/log-analytics-overview.md) to retrieve these logs.
@@ -68,8 +66,6 @@ DCRLogErrors
 DCR metrics are collected automatically for all DCRs, and you can analyze them using [metrics explorer](./analyze-metrics.md) like the platform metrics for other Azure resources. *Input stream* is included as a dimension so if you have a DCR with multiple input streams, you can analyze each by [filtering or splitting](./analyze-metrics.md#use-dimension-filters-and-splitting). Some metrics include other dimensions as shown in the table below.
 
 
-The following table describes the metrics collected for each DCR.
-
 | Metric | Dimensions | Description |
 |---|---|---|
 | Logs Ingestion Bytes per Min | Input Stream | Total number of bytes received per minute. |
@@ -100,7 +96,7 @@ The following signals could be useful for monitoring the health of your log coll
 | Sudden change in `Logs Ingestion Bytes per Min` | - Changes in configuration of log ingestion on the client, including AMA settings.<br>- Changes in structure of logs sent.|
 | Sudden change in ratio between `Logs Ingestion Bytes per Min` and `Logs Rows Received per Min` | - Changes in the structure of logs sent. Examine the changes to make sure the data is properly processed with KQL transformation. |
 | Sudden change in `Logs Transformation Duration per Min` | - Changes in the structure of logs affecting the efficiency of log filtering criteria set in KQL transformation. Examine the changes to make sure the data is properly processed with KQL transformation. |
-| `Logs Ingestion Requests per Min` or `Logs Ingestion Bytes per Min` approaching Log Ingestion API service limits. | Examine and optimize your DCR configuration to avoid throttling. |
+| `Logs Ingestion Requests per Min` or `Logs Ingestion Bytes per Min` approaching Log Ingestion API service limits. | - Examine and optimize your DCR configuration to avoid throttling. |
 
 ## Alerts
 Rather than reactively troubleshooting issues, create alert rules to be proactively notified when a potential error condition occurs. The following table provides examples of alert rules you can create to monitor your log ingestion.

articles/azure-monitor/essentials/data-collection-transformations.md

@@ -70,6 +70,9 @@ There are multiple methods to create transformations depending on the data colle
 | Transformation in workspace DCR | [Add workspace transformation to Azure Monitor Logs by using the Azure portal](../logs/tutorial-workspace-transformations-portal.md)<br>[Add workspace transformation to Azure Monitor Logs by using Resource Manager templates](../logs/tutorial-workspace-transformations-api.md)
 | Agent Transformations in a DCR | [Add transformation to Azure Monitor Log](../agents/azure-monitor-agent-transformation.md)
 
+## Monitor transformations
+See [Monitor and troubleshoot DCR data collection in Azure Monitor](data-collection-monitor.md) for details on logs and metrics that monitor the health and performance of transformations. This includes identifying any errors that occur in the KQL and metrics to track their running duration.
+
 ## Cost for transformations
 While transformations themselves don't incur direct costs, the following scenarios can result in additional charges:
 

articles/azure-monitor/logs/data-collection-troubleshoot.md

@@ -8,6 +8,8 @@ ms.date: 07/25/2023
 # Troubleshoot why data is no longer being collected in Azure Monitor
 This article provides guidance to detect when data collection in Azure Monitor stops and steps you can take to determine and correct the causes.
 
+> [!IMPORTANT]
+> If you're troubleshooting data collection for a scenario that uses a data collection rule (DCR) such as Azure Monitor agent or Logs ingestion API, see [Monitor and troubleshoot DCR data collection in Azure Monitor](./data-collection-monitor.md) for additional troubleshooting information.
 
 ## Data collection status
 When data collection in a Log Analytics workspace stops, an event with a type of **Operation** is created in the workspace. Run the following query to check whether you're reaching the daily limit and missing data: 

articles/azure-monitor/logs/data-ingestion-time.md

@@ -81,6 +81,8 @@ After log records are ingested into the Azure Monitor pipeline (as identified in
 
 Some solutions implement heavier algorithms to aggregate data and derive insights as data is streaming in. For example, Application Insights calculates application map data; Azure Network Performance Monitoring aggregates incoming data over 3-minute intervals, which effectively adds 3-minute latency.
 
+If the data collection includes an [ingestion-time transformation](../essentials/data-collection-transformations.md), then this will add some latency to the pipeline. Use the metric [Logs Transformation Duration per Min](../essentials/data-collection-monitor.md) to monitor the efficiency of the transformation query.
+
 Another process that adds latency is the process that handles custom logs. In some cases, this process might add a few minutes of latency to logs that are collected from files by the agent.
 
 ### New custom data types provisioning

articles/azure-monitor/logs/monitor-workspace.md

@@ -48,6 +48,9 @@ The following table describes the categories from the `_LogOperation` function.
 
 Ingestion operations are issues that occurred during data ingestion and include notification about reaching the Log Analytics workspace limits. Error conditions in this category might suggest data loss, so they're important to monitor. For service limits for Log Analytics workspaces, see [Azure Monitor service limits](../service-limits.md#log-analytics-workspaces).
 
+> [!IMPORTANT]
+> If you're troubleshooting data collection for a scenario that uses a data collection rule (DCR) such as Azure Monitor agent or Logs ingestion API, see [Monitor and troubleshoot DCR data collection in Azure Monitor](./data-collection-monitor.md) for additional troubleshooting information.
+
 #### Operation: Data collection stopped
 
 "Data collection stopped due to daily limit of free data reached. Ingestion status = OverQuota"