Merge log data from 2 different sources

[Jason Perron]

I have a "real time"'ish logger based on service bus + web job which posts to log analytics on every message.  At the same time, we also log the messages to disk.  I want to change this to batch messages and send more at a time to reduce the http calls. 

However, I am concerned about message loss in the scenario where the post to Log analytics fails.  Is there am automatic way to have a process merge the rolling log files from disk with what is already in log analytics?

[#2]

In the SQL world, if I'm understanding your question correctly, the equivalent would be an upsert. Unfortunately, LA does not today support this. However, because of the performance of the engine, we recommend in scenarios like yours that you index your data, and then select only the latest version when querying your data to dedup it. The other option of course is to handle it client side via robust retry logic, though this is more involved. Lastly, and this is not an option I've tried myself, but there exists a community-developed LogStash adapter for an OMS sink, LogStash potentially having some built in logic for dealing with rotating logs that you might find useful. Sorry for not having a cleaner answer for you, but hopefully one of these will work!