You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/summary-rules.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,15 +43,15 @@ Summary rules perform batch processing directly in your Log Analytics workspace.
43
43
44
44
:::image type="content" source="media/summary-rules/ingestion-flow.png" alt-text="A diagram that shows how data is ingested from various data sources to a Log Analytics workspace and is aggregated and reingested into the workspace by using a summary rule." lightbox="media/summary-rules/ingestion-flow.png":::
45
45
46
-
You can aggregate data from any table, regardless of whether the table has an [Analytics or Basic data plan](basic-logs-query.md). Azure Monitor creates the destination table schema based on the query you define. If the destination table already exists, Azure Monitor adds any columns required to support the query results.
47
-
48
-
You can configure up to 30 active rules to aggregate data from multiple tables and send the aggregated data to separate destination tables or the same table. All destination tables include a set of standard fields with summary rule information, including:
46
+
You can aggregate data from any table, regardless of whether the table has an [Analytics or Basic data plan](basic-logs-query.md). Azure Monitor creates the destination table schema based on the query you define. If the destination table already exists, Azure Monitor adds any columns required to support the query results. All destination tables also include a set of standard fields with summary rule information, including:
49
47
50
48
-`_RuleName`: The summary rule that generated the aggregated log entry.
51
49
-`_RuleLastModifiedTime`: When the rule was last modified.
52
50
-`_BinSize`: The aggregation interval.
53
51
-`_BinStartTime` The aggregation start time.
54
52
53
+
You can configure up to 30 active rules to aggregate data from multiple tables and send the aggregated data to separate destination tables or the same table.
54
+
55
55
You can export summarized data from a custom log table to a storage account or Event Hubs for further integrations by defining a [data export rule](logs-data-export.md).
56
56
57
57
### Example: Summarize ContainerLogsV2 data
@@ -104,19 +104,19 @@ The cost you incur for summary rules consists of the cost of the query on the so
104
104
| Analytics | No cost | Analytics ingested GB |
105
105
| Basic | Scanned GB | Analytics ingested GB |
106
106
107
-
For example, this is the cost calculation for hourly rule that returns 100 records per bin:
107
+
For example, this is the cost calculation for an hourly rule that returns 100 records per bin:
108
108
109
-
| Rule configuration | Monthly price calculation
109
+
| Source table plan | Monthly price calculation
110
110
| --- | --- |
111
-
|Query Analytics table| Ingestion price x record size x number of records x 24 hours x 30 days |
112
-
|Query Basic table| Scanned GB price x scanned size + Ingestion price x record size x number of records x 24 hours x 30 days |
111
+
| Analytics | Ingestion price x record size x number of records x 24 hours x 30 days |
112
+
| Basic | Scanned GB price x scanned size + Ingestion price x record size x number of records x 24 hours x 30 days |
113
113
114
114
For more information, see [Azure Monitor pricing](https://azure.microsoft.com/pricing/details/monitor/).
115
115
116
116
117
117
## Create or update a summary rule
118
118
119
-
Before you create a rule, experiment with the query in [Log Analytics](log-analytics-overview.md). Verify that the query doesn't reach or near the query limit. Confirm the query produces the intended schema and expected results. If the query is close to the query limits, consider using a smaller `binSize` to process less data per bin. You can also modify the query to return fewer records or remove fields with higher volume.
119
+
Before you create a rule, experiment with the query in [Log Analytics](log-analytics-overview.md). Verify that the query doesn't reach or near the query limit. Check that the query produces the intended schema and expected results. If the query is close to the query limits, consider using a smaller `binSize` to process less data per bin. You can also modify the query to return fewer records or remove fields with higher volume.
120
120
121
121
When you update a query and remove output fields from the results set, Azure Monitor doesn't automatically remove the columns from the destination table. You need to [delete columns from your table](create-custom-table.md#add-or-delete-a-custom-column) manually.
Summary rules are designed for scale, and include a retry mechanism to overcome transient service or query failures related to [query limits](../service-limits.md#log-analytics-workspaces), for example. The retry mechanism includes 10 attempts within eight hours and skips a bin, if exhausted. The rule is set to `isActive: false` and put on hold after eight consecutive bin retries. If you enable [monitor summary rules](#monitor-summary-rules), Azure Monitor logs an event in the `LASummaryLogs` table in your workspace.
436
+
Summary rules are designed for scale, and include a retry mechanism to overcome transient service or query failures related to [query limits](../service-limits.md#log-analytics-workspaces), for example. The retry mechanism makes 10 attempts to aggregate a failed bin within eight hours, and skips a bin, if exhausted. The rule is set to `isActive: false` and put on hold after eight consecutive bin retries. If you enable [monitor summary rules](#monitor-summary-rules), Azure Monitor logs an event in the `LASummaryLogs` table in your workspace.
437
437
438
438
You can't rerun a failed bin run, but you can use the following query to view failed runs:
0 commit comments