Forum Discussion
Single vs. multiple instances of Log Analytics
I have multiple client environments streaming data to Log Analytics. What are the pros and cons to use a single instance versus individual instnaces of Log Analytics. Please point me to the business...
- With single instance you will have to manage RBAC only on that instance with multiple you will have the burden to manage it on all of them. If you need to create a query that goes across multiple workspaces you will have to explicitly write in the query the workspaces you want to query. If you do not have any regulatory reasons to keep data in multiple workspaces I would suggest to move to a single one. The more data you have the better analysis you can do on your data.
Hi, Thanks for sharing the pros and cons of having a shared Log Analytics instance versus multiple workspaces for unique/individual client needs. In the case with multiple Log Analytics workspaces, can you please share the reference model/architecture that meet these needs?
From my perspective, I think we need to consider the following steps for the first client setup and repeat step 2 through step 4 for the next cleint :
- Have an Azure subscription.
- Choose a workspace name.
- Associate the workspace with the subscription.
- Choose a geographical location.
Stanislav_Zhelyazkov can you please validate the architecture and process? Thank you.
Hi, There isn't reference architecture or model when you have multiple workspaces. It depends on your scenario and requirements why would you have multiple workspaces and how you will use them. The agent even supports connecting to multiple workspaces so you could even have different solutions enabled on different workspaces for the same server. It really depends on your scenarios and your requirements. The steps below are not something that applies to Log Analytics. Log Analytics is an Azure service. As an Azure service you will need to have Azure Subscription. Inside your Azure subscription you choose to deploy Log Analytics with name and region.
Other reason for multiple workspaces are the data retention and cost impact. Some data you need 2 years, other only form the last 30 days
