You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Use the Bearer token for authentication. Read more about [using Bearer tokens](https://social.technet.microsoft.com/wiki/contents/articles/51140.azure-rest-management-api-the-quickest-way-to-get-your-bearer-token.aspx).
36
39
37
-
### Request body
40
+
**Request body**
41
+
38
42
|Name | Type | Description |
39
43
| --- | --- | --- |
40
44
|properties.plan | string | The table plan. Possible values are *Analytics* and *Basic*.|
41
45
42
-
### Example
46
+
**Example**
47
+
43
48
This example configures the `ContainerLog` table for Basic Logs.
@@ -67,7 +73,8 @@ Use this request body to change to Analytics Logs:
67
73
}
68
74
```
69
75
70
-
#### Sample response
76
+
**Sample response**
77
+
71
78
This is the response for a table changed to Basic Logs.
72
79
73
80
Status code: 200
@@ -87,6 +94,27 @@ Status code: 200
87
94
}
88
95
```
89
96
97
+
# [CLI](#tab/cli-1)
98
+
99
+
To configure a table for Basic Logs or Analytics Logs, run the [az monitor log-analytics workspace table update](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-update) command and set the `--plan` parameter to `Basic` or `Analytics`.
To check the configuration of a table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
182
+
183
+
For example:
184
+
185
+
```azurecli
186
+
az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace \
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/data-retention-archive.md
+65-25Lines changed: 65 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,32 +37,19 @@ To set the default workspace retention policy:
37
37
38
38
## Set retention and archive policy by table
39
39
40
-
You can set retention policies for individual tables, except for workspaces in the legacy Free Trial pricing tier, using Azure Resource Manager APIs. You cannot currently configure data retention for individual tables in the Azure portal.
40
+
You can set retention policies for individual tables, except for workspaces in the legacy Free Trial pricing tier, using Azure Resource Manager APIs. You can’t currently configure data retention for individual tables in the Azure portal.
41
41
42
42
You can keep data in interactive retention between 4 and 730 days. You can set the archive period for a total retention time of up to 2,555 days (seven years).
43
43
44
-
Each table is a sub-resource of the workspace it's in. For example, you can address the `SecurityEvent` table in [Azure Resource Manager](../../azure-resource-manager/management/overview.md) as:
44
+
Each table is a subresource of the workspace it's in. For example, you can address the `SecurityEvent` table in [Azure Resource Manager](../../azure-resource-manager/management/overview.md) as:
To get the retention policy of a particular table (in this example, `SecurityEvent`), Call the **Tables - Get** API:
55
-
56
-
```JSON
57
-
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables/SecurityEvent?api-version=2021-12-01-preview
58
-
```
59
-
60
-
To get all table-level retention policies in your workspace, don't set a table name; for example:
61
-
62
-
```JSON
63
-
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables?api-version=2021-12-01-preview
64
-
```
65
-
### Set the retention and archive policy for a table
52
+
# [API](#tab/api-1)
66
53
67
54
To set the retention and archive duration for a table, call the **Tables - Update** API:
68
55
@@ -79,24 +66,26 @@ You can use either PUT or PATCH, with the following difference:
79
66
- The **PUT** API sets *retentionInDays* and *totalRetentionInDays* to the default value if you don't set non-null values.
80
67
- The **PATCH** API doesn't change the *retentionInDays* or *totalRetentionInDays* values if you don't specify values.
81
68
69
+
**Request body**
82
70
83
-
#### Request body
84
71
The request body includes the values in the following table.
85
72
86
73
|Name | Type | Description |
87
74
| --- | --- | --- |
88
75
|properties.retentionInDays | integer | The table's data retention in days. This value can be between 4 and 730; or 1095, 1460, 1826, 2191, or 2556. <br/>Setting this property to null will default to the workspace retention. For a Basic Logs table, the value is always 8. |
89
76
|properties.totalRetentionInDays | integer | The table's total data retention including archive period. Set this property to null if you don't want to archive data. |
90
77
91
-
#### Example
92
-
The following table sets table retention to workspace default of 30 days, and total of 2 years. This means that the archive duration would be 23 months.
93
-
###### Request
78
+
**Example**
79
+
80
+
This example sets the table's interactive retention to the workspace default of 30 days, and the total retention to two years. This means the archive duration is 23 months.
To set the retention and archive duration for a table, run the [az monitor log-analytics workspace table update](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-update) command and pass the `--retention-time` and `--total-retention-time` parameters.
117
+
118
+
This example sets table's interactive retention to 30 days, and the total retention to two years. This means the archive duration is 23 months:
To reapply the workspace's default interactive retention value to the table and reset its total retention to 0, run the [az monitor log-analytics workspace table update](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-update) command with the `--retention-time` and `--total-retention-time` parameters set to `-1`.
To get the retention policy of a particular table (in this example, `SecurityEvent`), call the **Tables - Get** API:
141
+
142
+
```JSON
143
+
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables/SecurityEvent?api-version=2021-12-01-preview
144
+
```
145
+
146
+
To get all table-level retention policies in your workspace, don't set a table name; for example:
147
+
148
+
```JSON
149
+
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables?api-version=2021-12-01-preview
150
+
```
151
+
152
+
# [CLI](#tab/cli-2)
153
+
154
+
To get the retention policy of a particular table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
155
+
156
+
For example:
157
+
158
+
```azurecli
159
+
az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace \
160
+
--name SecurityEvent
161
+
```
162
+
163
+
---
164
+
125
165
## Purge retained data
126
166
When you shorten an existing retention policy, it takes several days for Azure Monitor to remove data that you no longer want to keep.
127
167
128
-
If you set the data retention policy to 30 days, you can purge older data immediately using the `immediatePurgeDataOn30Days` parameter in Azure Resource Manager. This can be useful when you need to remove personal data immediately. The immediate purge functionality is not available through the Azure portal.
168
+
If you set the data retention policy to 30 days, you can purge older data immediately using the `immediatePurgeDataOn30Days` parameter in Azure Resource Manager. The purge functionality is useful when you need to remove personal data immediately. The immediate purge functionality isn't available through the Azure portal.
129
169
130
170
Note that workspaces with a 30-day retention policy might actually keep data for 31 days if you don't set the `immediatePurgeDataOn30Days` parameter.
131
171
132
-
You can also purge data from a workspace using the [purge feature](personal-data-mgmt.md#how-to-export-and-delete-private-data), which removes personal data. You cannot purge data from archived logs.
172
+
You can also purge data from a workspace using the [purge feature](personal-data-mgmt.md#how-to-export-and-delete-private-data), which removes personal data. You can’t purge data from archived logs.
133
173
134
174
The Log Analytics [Purge API](/rest/api/loganalytics/workspacepurge/purge) doesn't affect retention billing. **To lower retention costs, decrease the retention period for the workspace or for specific tables.**
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/restore.md
+37-7Lines changed: 37 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,13 +22,17 @@ The restore operation creates the restore table and allocates additional compute
22
22
23
23
The destination table provides a view of the underlying source data, but does not affect it in any way. The table has no retention setting, and you must explicitly [dismiss the restored data](#dismiss-restored-data) when you no longer need it.
24
24
25
-
## Restore data using API
25
+
## Restore data
26
+
27
+
# [API](#tab/api-1)
26
28
To restore data from a table, call the **Tables - Create or Update** API. The name of the destination table must end with *_RST*.
27
29
28
30
```http
29
31
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{user defined name}_RST?api-version=2021-12-01-preview
30
32
```
31
-
### Request body
33
+
34
+
**Request body**
35
+
32
36
The body of the request must include the following values:
33
37
34
38
|Name | Type | Description |
@@ -37,7 +41,8 @@ The body of the request must include the following values:
37
41
|properties.restoredLogs.startRestoreTime | string | Start of the time range to restore. |
38
42
|properties.restoredLogs.endRestoreTime | string | End of the time range to restore. |
39
43
40
-
### Restore table status
44
+
**Restore table status**
45
+
41
46
The **provisioningState** property indicates the current state of the restore table operation. The API returns this property when you start the restore, and you can retrieve this property later using a GET operation on the table. The **provisioningState** property has one of the following values:
42
47
43
48
| Value | Description
@@ -46,7 +51,8 @@ The **provisioningState** property indicates the current state of the restore ta
46
51
| Succeeded | Restore operation completed. |
47
52
| Deleting | Deleting the restored table. |
48
53
49
-
#### Sample request
54
+
**Sample request**
55
+
50
56
This sample restores data from the month of January 2020 from the *Usage* table to a table called *Usage_RST*.
51
57
52
58
**Request**
@@ -67,21 +73,45 @@ PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000
67
73
}
68
74
}
69
75
```
76
+
# [CLI](#tab/cli-1)
70
77
78
+
To restore data from a table, run the [az monitor log-analytics workspace table restore create](/cli/azure/monitor/log-analytics/workspace/table/restore#az-monitor-log-analytics-workspace-table-restore-create) command.
To save costs, dismiss restored data when you no longer need it by deleting the restored table.
74
91
92
+
Deleting the restored table does not delete the data in the source table.
93
+
94
+
> [!NOTE]
95
+
> Restored data is available as long as the underlying source data is available. When you delete the source table from the workspace or when the source table's retention period ends, the data is dismissed from the restored table. However, the empty table will remain if you do not delete it explicitly.
96
+
97
+
# [API](#tab/api-2)
75
98
To delete a restore table, call the **Tables - Delete** API:
76
99
77
100
```http
78
101
DELETE https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{user defined name}_RST?api-version=2021-12-01-preview
79
102
```
80
-
Deleting the restored table does not delete the data in the source table.
103
+
# [CLI](#tab/cli-2)
81
104
82
-
> [!NOTE]
83
-
> Restored data is available as long as the underlying source data is available. When you delete the source table from the workspace or when the source table's retention period ends, the data is dismissed from the restored table. However, the empty table will remain if you do not delete it explicitly.
105
+
To delete a restore table, run the [az monitor log-analytics workspace table delete](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-delete) command.
0 commit comments