Log Analytics workspace

Sends each record to a Log Analytics table, through a data collection rule.

Example

Sends to the stream Custom-Events_CL of a data collection rule, signed in as the host's managed identity.

{
  "id": "events-out",
  "type": "logAnalytics",
  "endpoint": "https://acme-logs-a1b2.eastus-1.ingest.monitor.azure.com",
  "ruleId": "dcr-0123456789abcdef0123456789abcdef",
  "stream": "Custom-Events_CL"
}

Before you start

  • Create the table and a data collection rule with a stream that sends to it. See Microsoft's Logs Ingestion API tutorial.
  • Choose how the destination signs in, with exactly one of:
    • a service principal: set tenantId, clientId and clientSecret, with the secret in a credential.
    • a user-assigned managed identity: set managedIdentityClientId to its client id. Set it when the host has more than one managed identity.
    • none: the destination signs in as the host's managed identity, or as an AKS pod's workload identity. The managed identities of App Service, Container Apps and Functions are not supported.
    See Microsoft's Logs Ingestion API docs for the role it needs.
  • Allow workers to reach the endpoint on port 443.

Settings

It also takes the settings every destination takes.

endpoint string required

The data collection rule's logs ingestion endpoint, or the data collection endpoint it is linked to.

Examples
https://acme-logs-a1b2.eastus-1.ingest.monitor.azure.comhttps://acme-dce-x9y8.eastus-1.ingest.monitor.azure.us

ruleId string required

The data collection rule's immutable id.

Example
dcr-00000000000000000000000000000000

stream string required

The rule's input stream the records are sent to.

Examples
Custom-Events_CLCustom-Firewall

tenantId string default none

A service principal's tenant. Set tenantId, clientId and clientSecret together, or none of them.

Example
00000000-0000-0000-0000-000000000000

clientId string default none

A service principal's client id.

Example
11111111-1111-1111-1111-111111111111

clientSecret credential default none

The credential holding a service principal's client secret.

Examples
AZURE_CLIENT_SECRET{"secret": "azure-client-secret","version": 1}

managedIdentityClientId string default the host's managed or workload identity

The client id of the user-assigned managed identity to sign in as. Set it when the worker's host has more than one managed identity. Left out, it signs in as the host's managed identity, or an AKS pod's workload identity.

Example
22222222-2222-2222-2222-222222222222

Advanced

authEndpoint string default its cloud's own

Where a client secret is exchanged for a token. Only with clientSecret.

Examples
https://login.microsoftonline.ushttps://login.chinacloudapi.cn

identity identity default none

The connection identity it connects under, for a private CA or a client certificate. Only on an https:// URL.

Examples
intake-clientintake-mtls

inFlight integer default 4

How many requests it sends at once to start with. 1 to 64.

Examples
8116

maxRequestBytes size default 1 MiB

The most one request carries, before compression. A record larger than this still goes as a single record. 4 KiB to 1 MiB.

Examples
512 KiB256 KiB

bufferBytes size default 64 MiB, or one request if that is larger

How much undelivered output it may hold. 4 MiB to 1 GiB, and at least one request.

Examples
256 MiB64 MiB1 GiB

stallAfterSecs integer default 30

Seconds one batch may take to deliver, every retry included, before the destination reports it stalled. 1 to 120.

Examples
60120

How it works

The destination sends each batch as one gzipped JSON array to the rule's stream, signed in through Entra ID. It reads no __destination field. It handles each answer as the HTTP destination does.

Verify

Send a record you can recognize through the source, then query its table in the workspace.

Troubleshooting

The destination stalls, saying its credentials were refused
Check that the identity it signs in as has the role the rule needs.
The destination stalls on a 404
Check the rule id, the stream, and that the endpoint is the rule's.

See also