Hi,
I am trying to read yml file exported from Log Analytics workspace by using logic app. It fails with 404 do not find the file. I do not see differnce in output and the link to the data in blob
workspace is bound with ER traffic collector give updates every 5 minutes
{ "status": 404, "message": "Specified resource /am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=43/PT5M.json not found.\r\nclientRequestId: 7cf43ce9-64b9-4f28-a332-a9bde2c55960", "error": { "message": "Specified resource /am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=45/PT5M.json not found." }, "source": "azureblob-we.azconn-we-002.p.azurewebsites.net" }
The URL of the file is
https://ertrafficcollectorsa.blob.core.windows.net/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=2025/m=08/d=28/h=07/m=45/PT5M.json
Thanks for your review in adv.....
The Logic app code is
{
"definition": {
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
"contentVersion": "1.0.0.0",
"triggers": {
"When_a_resource_event_occurs": {
"type": "ApiConnectionWebhook",
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azureeventgrid-1']['connectionId']"
}
},
"body": {
"properties": {
"topic": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Storage/storageAccounts/ertrafficcollectorsa",
"destination": {
"endpointType": "webhook",
"properties": {
"endpointUrl": "@listCallbackUrl()"
}
},
"filter": {
"includedEventTypes": [
"Microsoft.Storage.BlobCreated"
],
"subjectBeginsWith": "/blobServices/default/containers/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/",
"subjectEndsWith": ".json"
}
}
},
"path": "/subscriptions/@{encodeURIComponent('9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2')}/providers/@{encodeURIComponent('Microsoft.Storage.StorageAccounts')}/resource/eventSubscriptions",
"queries": {
"x-ms-api-version": "2017-09-15-preview"
}
}
}
},
"actions": {
"Log_Blob_Path": {
"runAfter": {},
"type": "Compose",
"inputs": "@coalesce(triggerBody()?['data']?['url'], 'no-url')"
},
"Get_blob_content_(V2)": {
"runAfter": {
"Lists_blobs_(V2)": [
"Succeeded"
]
},
"trackedProperties": {
"BlobData": "@outputs('Get_blob_content_(V2)')"
},
"limit": {
"timeout": "PT1M"
},
"type": "ApiConnection",
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azureblob']['connectionId']"
}
},
"method": "get",
"path": "/v2/datasets/@{encodeURIComponent(encodeURIComponent('ertrafficcollectorsa'))}/files/@{encodeURIComponent(encodeURIComponent('/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=',formatDateTime(utcNow(),'yyyy'),'/m=',formatDateTime(utcNow(),'MM'),'/d=',formatDateTime(utcNow(),'dd'),'/h=',formatDateTime(utcNow(),'HH'),'/m=',formatDateTime(utcNow(),'mm'),'/'))}/content",
"queries": {
"inferContentType": true
}
}
},
"HTTP": {
"runAfter": {
"Get_blob_content_(V2)": [
"Succeeded"
]
},
"trackedProperties": {
"StatusCode": "@outputs('HTTP')?['statusCode']"
},
"limit": {
"timeout": "PT1M"
},
"type": "Http",
"inputs": {
"uri": "https://hec-splunk.tnz.nld9.paas.westeurope.prdcur.az.amadeus.net/services/collector/event",
"method": "POST",
"headers": {
"Splunk": "12fdf828-fd10-4796-bba8-09446706ae99",
"Content-Type": "application/json"
},
"body": {
"time": "",
"host": "fw-ertrafficcollector-log-to-splunk-LApp",
"source": "azure_blob",
"sourcetype": "_json",
"event": "@body('Get_blob_content_(V2)')"
}
},
"runtimeConfiguration": {
"contentTransfer": {
"transferMode": "Chunked"
}
}
},
"Lists_blobs_(V2)": {
"runAfter": {
"Log_Blob_Path": [
"Succeeded"
]
},
"metadata": {
"JTJmYW0tYXRjZXhwcmVzc3JvdXRlY2lyY3VpdGlwZml4": "/am-atcexpressroutecircuitipfix"
},
"type": "ApiConnection",
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azureblob']['connectionId']"
}
},
"method": "get",
"path": "/v2/datasets/@{encodeURIComponent(encodeURIComponent('AccountNameFromSettings'))}/foldersV2/@{encodeURIComponent(encodeURIComponent('/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=',formatDateTime(utcNow(),'yyyy'),'/m=',formatDateTime(utcNow(),'MM'),'/d=',formatDateTime(utcNow(),'dd'),'/h=',formatDateTime(utcNow(),'HH'),'/m=',formatDateTime(utcNow(),'mm'),'/PT5M.json'))}",
"queries": {
"nextPageMarker": "",
"useFlatListing": true
}
}
}
},
"outputs": {},
"parameters": {
"$connections": {
"type": "Object",
"defaultValue": {}
}
}
},
"parameters": {
"$connections": {
"type": "Object",
"value": {
"azureeventgrid-1": {
"id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureeventgrid",
"connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureeventgrid-1",
"connectionName": "azureeventgrid-1"
},
"azureblob": {
"id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureblob",
"connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureblob",
"connectionName": "azureblob"
}
}
}
}
}
"sourcetype": "_json",
"event": "@body('Get_blob_content_(V2)')"
}
},
"runtimeConfiguration": {
"contentTransfer": {
"transferMode": "Chunked"
}
}
},
"Lists_blobs_(V2)": {
"runAfter": {
"Log_Blob_Path": [
"Succeeded"
]
},
"metadata": {
"JTJmYW0tYXRjZXhwcmVzc3JvdXRlY2lyY3VpdGlwZml4": "/am-atcexpressroutecircuitipfix"
},
"type": "ApiConnection",
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azureblob']['connectionId']"
}
},
"method": "get",
"path": "/v2/datasets/@{encodeURIComponent(encodeURIComponent('AccountNameFromSettings'))}/foldersV2/@{encodeURIComponent(encodeURIComponent('/am-atcexpressroutecircuitipfix/WorkspaceResourceId=/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourcegroups/prd-netcs-erdirect-westeu-01/providers/microsoft.operationalinsights/workspaces/erdirect-ams-trafficcollector-log/y=',formatDateTime(utcNow(),'yyyy'),'/m=',formatDateTime(utcNow(),'MM'),'/d=',formatDateTime(utcNow(),'dd'),'/h=',formatDateTime(utcNow(),'HH'),'/m=',formatDateTime(utcNow(),'mm'),'/PT5M.json'))}",
"queries": {
"nextPageMarker": "",
"useFlatListing": true
}
}
}
},
"outputs": {},
"parameters": {
"$connections": {
"type": "Object",
"defaultValue": {}
}
}
},
"parameters": {
"$connections": {
"type": "Object",
"value": {
"azureeventgrid-1": {
"id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureeventgrid",
"connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureeventgrid-1",
"connectionName": "azureeventgrid-1"
},
"azureblob": {
"id": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/providers/Microsoft.Web/locations/westeurope/managedApis/azureblob",
"connectionId": "/subscriptions/9cfc029e-cd84-4bd3-b3bb-7cfa9095e6c2/resourceGroups/prd-netcs-erdirect-westeu-01/providers/Microsoft.Web/connections/azureblob",
"connectionName": "azureblob"
}
}
}
}
}