Ingest Logs and Verify
A 3-step recipe with Azure Log Analytics. We can help you get access.
Recipe · 3 steps
Ingest Logs and Verify
with Azure Log Analytics
Read the target table, upload logs through a DCR, then query to verify.
- Read the management definition of the destination table to confirm it exists and expose its current schema before ingesting.
- Send the batch of log entries through the data collection rule stream to the ingestion endpoint. A 204 indicates the data was accepted.
- Run the verification KQL query against the table to confirm the ingested rows are queryable.
What you'll need to have ready
- subscriptionId: The ID of the target Azure subscription.
- resourceGroupName: The resource group that contains the workspace.
- workspaceName: The management name of the Log Analytics workspace.
- tableName: The name of the destination table to confirm and query.
- dcrImmutableId: The immutable ID of the data collection rule used for ingestion.
- streamName: The DCR stream name that handles the data (e.g. Custom-MyTable).
- logEntries: The batch of log entry objects to upload.
- workspaceId: The customer (workspace) GUID used by the query endpoint.
- verifyQuery: The KQL query used to verify the ingested rows are present.
- timespan: Optional ISO 8601 duration limiting the verification query (e.g. PT1H).
- managementApiVersion: The management API version to use.
- ingestionApiVersion: The ingestion API version to use.
For your developer
Arazzo workflow azure-log-analytics:ingest-and-verify, 3 operations: getTable → uploadLogs → postQuery. Specs on APIs.io.