Edit

Share via

Set up a table with the Auxiliary plan in your Log Analytics workspace

  • Article

The Auxiliary table plan lets you ingest and retain data in your Log Analytics workspace at a low cost.

Here's a video that explains some of the uses and benefits of the Auxiliary table plan:

Azure Monitor Logs currently supports the Auxiliary table plan on data collection rule (DCR)-based custom tables to which you send data you collect using Azure Monitor Agent or the Logs ingestion API.

This article explains how to create a new custom table with the Auxiliary plan in your Log Analytics workspace and set up a data collection rule that sends data to this table.

Prerequisites

To create a custom table and collect log data, you need:

  • A Log Analytics workspace where you have at least contributor rights.
  • A data collection endpoint (DCE).
  • Setting up a table with the Auxiliary plan is only supported on new tables. After you create a table with an Auxiliary plan, you can't switch the table's plan.

Note

Auxiliary logs are generally available (GA) for all public cloud regions, but not available for Azure Government or China clouds.

Create a custom table with the Auxiliary plan

To create a custom table, call the Tables - Create API by using this command:

PUT https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.OperationalInsights/workspaces/{workspace_name}/tables/{table name_CL}?api-version=2023-01-01-preview

Note

Only version 2023-01-01-preview of the API currently lets you set the Auxiliary table plan.

Provide this payload as the body of your request. Update the table name and adjust the columns based on your table schema. This sample lists all the supported column data types.

 {
    "properties": {
        "schema": {
            "name": "table_name_CL",
            "columns": [
                {
                    "name": "TimeGenerated",
                    "type": "datetime"
                },
                {
                    "name": "StringProperty",
                    "type": "string"
                },
                {
                    "name": "IntProperty",
                    "type": "int"
                },
                 {
                    "name": "LongProperty",
                    "type": "long"
                },
                 {
                    "name": "RealProperty",
                    "type": "real"
                },
                 {
                    "name": "BooleanProperty",
                    "type": "boolean"
                },
                 {
                    "name": "GuidProperty",
                    "type": "real"
                },
                 {
                    "name": "DateTimeProperty",
                    "type": "datetime"
                }
            ]
        },
        "totalRetentionInDays": 365,
        "plan": "Auxiliary"
    }
}

Note

  • The TimeGenerated column only supports the ISO 8601 format with 6 decimal places for precision (nanoseconds). For more information, see supported ISO 8601 datetime format.
  • Tables with the Auxiliary plan don't support columns with dynamic data.

Send data to a table with the Auxiliary plan

There are currently two ways to ingest data to a custom table with the Auxiliary plan:

  • Collect logs from a text file with Azure Monitor Agent / Collect logs from a JSON file with Azure Monitor Agent.

    If you use this method, your custom table must only have two columns - TimeGenerated and RawData (of type string). The data collection rule sends the entirety of each log entry you collect to the RawData column, and Azure Monitor Logs automatically populates the TimeGenerated column with the time the log is ingested.

  • Send data to Azure Monitor using Logs ingestion API.

    To use this method:

    1. Create a custom table with the Auxiliary plan as described in this article.

    2. Follow the steps described in Tutorial: Send data to Azure Monitor using Logs ingestion API to:

      1. Create a Microsoft Entra application.

      2. Create a data collection rule using this ARM template.

      {
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "dataCollectionRuleName": {
            "type": "string",
            "metadata": {
                "description": "Specifies the name of the data collection rule to create."
            }
        },
        "location": {
            "type": "string",
            "metadata": {
                "description": "Specifies the region in which to create the data collection rule. The must be the same region as the destination Log Analytics workspace."
            }
        },
        "workspaceResourceId": {
            "type": "string",
            "metadata": {
                "description": "The Azure resource ID of the Log Analytics workspace in which you created a custom table with the Auxiliary plan."
            }
        }
    },
    "resources": [
        {
            "type": "Microsoft.Insights/dataCollectionRules",
            "name": "[parameters('dataCollectionRuleName')]",
            "location": "[parameters('location')]",
            "apiVersion": "2023-03-11",
            "kind": "Direct",
            "properties": {
                "streamDeclarations": {
                    "Custom-table_name_CL": {
                        "columns": [
                            {
                                "name": "TimeGenerated",
                                "type": "datetime"
                            },
                            {
                                "name": "StringProperty",
                                "type": "string"
                            },
                            {
                                "name": "IntProperty",
                                "type": "int"
                            },
                            {
                                "name": "LongProperty",
                                "type": "long"
                            },
                            {
                                "name": "RealProperty",
                                "type": "real"
                            },
                            {
                                "name": "BooleanProperty",
                                "type": "boolean"
                            },
                            {
                                "name": "GuidProperty",
                                "type": "real"
                            },
                            {
                                "name": "DateTimeProperty",
                                "type": "datetime"
                            }
                                ]
                                }
                            },
                "destinations": {
                    "logAnalytics": [
                        {
                            "workspaceResourceId": "[parameters('workspaceResourceId')]",
                            "name": "myworkspace"
                        }
                    ]
                },
                "dataFlows": [
                    {
                        "streams": [
                            "Custom-table_name_CL"
                        ],
                        "destinations": [
                            "myworkspace"
                        ]
                    }
                ]
            }
        }
    ],
    "outputs": {
        "dataCollectionRuleId": {
            "type": "string",
            "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
        }
    }
}

      Where:

    3. Grant your application permission to use your DCR.

    Note

    A data collection rule that sends data to a table with an Auxiliary plan:

    • Can only send data to a single table.
    • Can't include a transformation.

Next steps

Learn more about: