Forum Discussion
Log analytics results is late for South Brazil
Hi
If you are quering this way
Heartbeat
You will get inconsistant alerts. With the new query langauge you have to specify the sorting. In the old one sorting was always done on TimeGenerated if not specified. So you have to do query like this to get the latest data
Heartbeat | sort by TimeGenerated desc
Otherwise there is no change on how logs are ingested into Log Analytics.
Hi Sean,
On this test i have about ~20 minutes in a simple query results.
Hi
If you are quering this way
Heartbeat
You will get inconsistant alerts. With the new query langauge you have to specify the sorting. In the old one sorting was always done on TimeGenerated if not specified. So you have to do query like this to get the latest data
Heartbeat | sort by TimeGenerated desc
Otherwise there is no change on how logs are ingested into Log Analytics.
Hi,
I've noticed the same problem in my workspace. It doesn’t matter if you sort your query results by TimeGenerated or not. The Heartbeats are just late in some cases... Sometimes up to 20 minutes, which makes alerting based on missing heartbeats unreliable.
According to the Microsoft support this is all fine, because it is in the SLA of 6hours!
"We guarantee that at least 99.9% of the time, log data will be indexed within six hours of the data being queued for indexing by the Operations Management Suite Log Analytics Service."
You can check this here: https://azure.microsoft.com/en-in/support/legal/sla/log-analytics/v1_1/
Hi all,
Overall Log Analytics is meant for warm path. Currently we have preview of near real time metrics (sub minute) for alerting purposes. If you are interested please see https://azure.microsoft.com/en-us/blog/get-alerts-faster-with-near-real-time-alerting-for-azure-platform-metrics/
- The preview is only for Azure resources metrics Ketan. Heartbeat is something that comes from MMA agent.
