Forum Discussion
Log analytics agent basic logs / analytics logs
Does this mean the log analytics agent will be able to send important logs directly to the LAW and mundane logs into basic logs? Or will you still need some proxy/log collector in between to distinguish all that for you?
Example: I have an on-prem windows server. Will I be able to make a distinguishment with logon information and perhaps dns data ?
3 Replies
Looking at the documents, it looks like basic logs will apply at a table level, and only certain types of tables are supported.
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/basic-logs-configure?tabs=api-1%2Cportal-1Looking at the types of tables that are supported for basic logs, it does not look like you could do this with logon info and dns data from regular windows servers, unless you somehow use a REST API client with the Data Collection Rule (DCR)-based custom logs API.
- That might indeed be possible.
However, you would need to use the Data Collection Rule (DCR)-based custom logs API.
The current data connector for logstash does not use the above API, but instead uses the HTTP Data Collector REST API, so you would need to migrate to the required API or not use the data connector at all.
https://docs.microsoft.com/en-us/azure/sentinel/connect-logstash
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate
I do not have any experience here so cannot give a definite answer unfortunately.
