Use of logic App to read JSON file from blob container with dynamic directory

Sandor TOTH 20 Reputation points
2025-08-28T08:16:30.74+00:00

Hi,

I am trying to read yml file exported from Log Analytics workspace by using logic app. It fails with 404 do not find the file. I do not see differnce in output and the link to the data in blob

workspace is bound with ER traffic collector give updates every 5 minutes

{ "status": 404, "message": "Specified resource /am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=43/PT5M.json not found.\r\nclientRequestId: 7cf43ce9-64b9-4f28-a332-a9bde2c55960", "error": { "message": "Specified resource /am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=45/PT5M.json not found." }, "source": "azureblob-we.azconn-we-002.p.azurewebsites.net" }

The URL of the file is
https://ertrafficcollectorsa.blob.core.windows.net/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=45/PT5M.json

Thanks for your review in adv.....
The Logic app code is

{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "When_a_resource_event_occurs": {
                "type": "ApiConnectionWebhook",
                "inputs": {
                    "host": {
                        "connection": {
                            "name": "@parameters('$connections')['azureeventgrid-1']['connectionId']"
                        }
                    },
                    "body": {
                        "properties": {
                            "topic": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Storage/storageAccounts/ertrafficcollectorsa",
                            "destination": {
                                "endpointType": "webhook",
                                "properties": {
                                    "endpointUrl": "@listCallbackUrl()"
                                }
                            },
                            "filter": {
                                "includedEventTypes": [
                                    "Microsoft.Storage.BlobCreated"
                                ],
                                "subjectBeginsWith": "/blobServices/default/containers/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/",
                                "subjectEndsWith": ".json"
                            }
                        }
                    },
                    "path": "/subscriptions/@{encodeURIComponent('9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2')}/providers/@{encodeURIComponent('Microsoft.Storage.StorageAccounts')}/resource/eventSubscriptions",
                    "queries": {
                        "x-ms-api-version": "2017-09-15-preview"
                    }
                }
            }
        },
        "actions": {
            "Log_Blob_Path": {
                "runAfter": {},
                "type": "Compose",
                "inputs": "@coalesce(triggerBody()?['data']?['url'], 'no-url')"
            },
            "Get_blob_content_(V2)": {
                "runAfter": {
                    "Lists_blobs_(V2)": [
                        "Succeeded"
                    ]
                },
                "trackedProperties": {
                    "BlobData": "@outputs('Get_blob_content_(V2)')"
                },
                "limit": {
                    "timeout": "PT1M"
                },
                "type": "ApiConnection",
                "inputs": {
                    "host": {
                        "connection": {
                            "name": "@parameters('$connections')['azureblob']['connectionId']"
                        }
                    },
                    "method": "get",
                    "path": "/v2/datasets/@{encodeURIComponent(encodeURIComponent('ertrafficcollectorsa'))}/files/@{encodeURIComponent(encodeURIComponent('/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=',formatDateTime(utcNow(),'yyyy'),'/m=',formatDateTime(utcNow(),'MM'),'/d=',formatDateTime(utcNow(),'dd'),'/h=',formatDateTime(utcNow(),'HH'),'/m=',formatDateTime(utcNow(),'mm'),'/'))}/content",
                    "queries": {
                        "inferContentType": true
                    }
                }
            },
            "HTTP": {
                "runAfter": {
                    "Get_blob_content_(V2)": [
                        "Succeeded"
                    ]
                },
                "trackedProperties": {
                    "StatusCode": "@outputs('HTTP')?['statusCode']"
                },
                "limit": {
                    "timeout": "PT1M"
                },
                "type": "Http",
                "inputs": {
                    "uri": "https://hec-splunk.tnz.nld9.paas.westeurope.prdcur.az.amadeus.net/services/collector/event",
                    "method": "POST",
                    "headers": {
                        "Splunk": "12fdf828-fd10-4796-bba8-09446706ae99",
                        "Content-Type": "application/json"
                    },
                    "body": {
                        "time": "",
                        "host": "fw-ertrafficcollector-log-to-splunk-LApp",
                        "source": "azure_blob",
                        "sourcetype": "_json",
                        "event": "@body('Get_blob_content_(V2)')"
                    }
                },
                "runtimeConfiguration": {
                    "contentTransfer": {
                        "transferMode": "Chunked"
                    }
                }
            },
            "Lists_blobs_(V2)": {
                "runAfter": {
                    "Log_Blob_Path": [
                        "Succeeded"
                    ]
                },
                "metadata": {
                    "JTJmYW0tYXRjZXhwcmVzc3JvdXRlY2lyY3VpdGlwZml4": "/am-atcexpressroutecircuitipfix"
                },
                "type": "ApiConnection",
                "inputs": {
                    "host": {
                        "connection": {
                            "name": "@parameters('$connections')['azureblob']['connectionId']"
                        }
                    },
                    "method": "get",
                    "path": "/v2/datasets/@{encodeURIComponent(encodeURIComponent('AccountNameFromSettings'))}/foldersV2/@{encodeURIComponent(encodeURIComponent('/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=',formatDateTime(utcNow(),'yyyy'),'/m=',formatDateTime(utcNow(),'MM'),'/d=',formatDateTime(utcNow(),'dd'),'/h=',formatDateTime(utcNow(),'HH'),'/m=',formatDateTime(utcNow(),'mm'),'/PT5M.json'))}",
                    "queries": {
                        "nextPageMarker": "",
                        "useFlatListing": true
                    }
                }
            }
        },
        "outputs": {},
        "parameters": {
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {
                "azureeventgrid-1": {
                    "id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureeventgrid",
                    "connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureeventgrid-1",
                    "connectionName": "azureeventgrid-1"
                },
                "azureblob": {
                    "id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureblob",
                    "connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureblob",
                    "connectionName": "azureblob"
                }
            }
        }
    }
}
                        "sourcetype": "_json",
                        "event": "@body('Get_blob_content_(V2)')"
                    }
                },
                "runtimeConfiguration": {
                    "contentTransfer": {
                        "transferMode": "Chunked"
                    }
                }
            },
            "Lists_blobs_(V2)": {
                "runAfter": {
                    "Log_Blob_Path": [
                        "Succeeded"
                    ]
                },
                "metadata": {
                    "JTJmYW0tYXRjZXhwcmVzc3JvdXRlY2lyY3VpdGlwZml4": "/am-atcexpressroutecircuitipfix"
                },
                "type": "ApiConnection",
                "inputs": {
                    "host": {
                        "connection": {
                            "name": "@parameters('$connections')['azureblob']['connectionId']"
                        }
                    },
                    "method": "get",
                    "path": "/v2/datasets/@{encodeURIComponent(encodeURIComponent('AccountNameFromSettings'))}/foldersV2/@{encodeURIComponent(encodeURIComponent('/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=',formatDateTime(utcNow(),'yyyy'),'/m=',formatDateTime(utcNow(),'MM'),'/d=',formatDateTime(utcNow(),'dd'),'/h=',formatDateTime(utcNow(),'HH'),'/m=',formatDateTime(utcNow(),'mm'),'/PT5M.json'))}",
                    "queries": {
                        "nextPageMarker": "",
                        "useFlatListing": true
                    }
                }
            }
        },
        "outputs": {},
        "parameters": {
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {
                "azureeventgrid-1": {
                    "id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureeventgrid",
                    "connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureeventgrid-1",
                    "connectionName": "azureeventgrid-1"
                },
                "azureblob": {
                    "id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureblob",
                    "connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureblob",
                    "connectionName": "azureblob"
                }
            }
        }
    }
}
Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
{count} votes

Answer accepted by question author
  1. Praveen Kumar Gudipudi 1,495 Reputation points Microsoft External Staff Moderator
    2025-09-17T13:03:15.1066667+00:00

    Sandor TOTH,,

    Issue: { "status": 404, "message": "Specified resource /am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=43/PT5M.json not found.\r\nclientRequestId: 7cf43ce9-64b9-4f28-a332-a9bde2c55960", "error": { "message": "Specified resource /am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=45/PT5M.json not found." }, "source": "azureblob-we.azconn-we-002.p.azurewebsites.net" } error in blob connector.

    Resolution: By increasing the action time out limit to PT10M issue got resolved.

    Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.

    User's image

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.