Logic app to send logs to Azure blob storage failing

[Saeed Sheikh]

Hello All,

I have implemented a Logic App to move logs from LA workspace to Azure storage as outlined in this blog post by Nicolas Prigent.

I am getting this error at the until step.

BadRequest. Http request failed as there is an error: 'Cannot write more bytes to the buffer than the configured maximum buffer size: 104857600.'.

The query it is running at the step is this.

 SecurityEvent
| where ingestion_time() between(datetime(2022-04-27T05:00:00.0000000) .. datetime(2022-04-27T06:00:00.0000000))

When I manually ran this query in Log Analytics, I got more than 15k results. How can I increase the buffer size? Is there a better solution? Thank you for your response.

-Saeed

[#2]

You can't increase the buffer size, so you will need to reduce the amount of data you save in one go.
This can be done either by adjusting the time interval (for example by doing it in 30 minute intervals instead of 1 hour intervals), or by splitting in a fixed line of records interval (for examply 5000 lines a time).

The post below explains this in more detail.
https://techcommunity.microsoft.com/t5/integrations-on-azure-blog/how-to-use-logic-apps-to-handle-la...

You never know how much logs will be present in a specific time interval though, especially since the environment might be growing, so the only way that will (most likely) not require re-adjustment is to do it by fixed line of records.