Log Analytics data export let’s you export data of selected tables in your Log Analytics workspace as it reaches ingestion and continuously export it to a Azure storage account and event hub.
Data export was design as the native export path for Log Analytics data and in some cases, can replace alternative solutions used based on query API and were bounded to its limits. Once data export rules are configured in your workspace, any new data arriving at Log Analytics ingestion endpoint and targeted to selected tables in your workspace is exported to your storage account hourly or to event hub in near-real-time.
When exporting to storage, each table is kept under a separate container. Similarly, when exporting to Event Hub, each table is exported to a new event hub instance. Data export is regional and can be configured when your workspace and destination (storage account, event hub) are located in the same region. If you need to replicate your data to other storage account(s), you can use any of the Azure Storage redundancy alternatives.
Configuration is currently available via CLI and REST request and the support in UI, but PowerShell will be added in the near future.
Here is an example of data export rule to storage account – if a table that you defined isn’t supported currently, no data will be exported to destination, but once it gets supported, data will start being exported automatically.
# Get a list of tables in your workspace az monitor log-analytics workspace table list -g $resourceGroup --workspace-name $workspace --query .name --output table
#Create export rule to storage in your workspace az monitor log-analytics workspace data-export create -g $resourceGroup --workspace-name $workspace -n ExportRuleName --tables ` InsightsMetrics ` SecurityEvent ` Heartbeat ` Perf ` WireData ` ConfigurationChange ` --destination $storageAccountId
All regions except Switzerland North, Switzerland West and government clouds. The support for these will be added gradually.
Please do let us know of any questions or feedback you have around the feature.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.