Edit

Set up a table with the Auxiliary plan in your Log Analytics workspace

The Auxiliary table plan lets you ingest and retain data in your Log Analytics workspace at a low cost.

Here's a video that explains some of the uses and benefits of the Auxiliary table plan:

Azure Monitor Logs currently supports the Auxiliary table plan on data collection rule (DCR)-based custom tables to which you send data you collect using Azure Monitor Agent or the Logs ingestion API.

This article explains how to create a new custom table with the Auxiliary plan in your Log Analytics workspace and set up a data collection rule that sends data to this table. For more information about Auxiliary plan concepts, see Azure Monitor Logs table plans.

Prerequisites

To create a custom table and collect log data, you need:

  • A Log Analytics workspace where you have at least contributor rights.
  • A data collection endpoint (DCE).
  • Setting up a table with the Auxiliary plan is only supported on new tables. After you create a table with an Auxiliary plan, you can't switch the table's plan.

Note

Auxiliary logs are generally available (GA) for all public cloud regions except for Qatar Central, and not available for Azure Government or China clouds.

Create a custom table with the Auxiliary plan

To create a custom table with the Auxiliary plan in the Azure portal:

  1. From the Log Analytics workspaces menu, select Tables.

  2. Select Create.

  3. On the Basics tab, specify a name and, optionally, a description for the table. The portal automatically adds the _CL suffix to the table name.

  4. Under Table plan, select Auxiliary / Lake.

  5. Select Next and complete the remaining steps to configure the schema and data collection. For detailed instructions on the remaining steps, see Add or delete tables and columns in Azure Monitor Logs.

Note

This sample lists all the supported column data types.

Variable Example value Purpose
host management.azure.com Implicit ARM endpoint
subscriptionId aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e User input
resourceGroupName myResourceGroup User input
workspaceName myWorkspace User input
tableName_CL myTable_CL User input
apiVersion 2025-07-01 Reference

Send data to a table with the Auxiliary plan

There are multiple ways to ingest data to a custom table with the Auxiliary plan:

  • Azure Monitor Agent (AMA)
  • Logs ingestion API
  • Workspace transformation

Use the AMA

If you use this method, your custom table must only have two columns - TimeGenerated (type datetime) and RawData (of type string). The data collection rule sends the entirety of each log entry you collect to the RawData column, and Azure Monitor Logs automatically populates the TimeGenerated column with the time the log is ingested.

For more information on how to use the AMA, see the following articles:

Use the logs ingestion API

This method closely follows the steps described in Tutorial: Send data to Azure Monitor using Logs ingestion API.

  1. Create a custom table with the Auxiliary plan as described in this article.

  2. Create a Microsoft Entra application.

  3. Create a data collection rule. Here's a sample ARM template for kind: Direct. This type of DCR doesn't require a DCE since it includes a logsIngestion endpoint.

    • myWorkspace is the name of your Log Analytics workspace.
    • myTable_CL is the name of your table.
    • columns includes the same columns you set in the creation of the table.

    The following Azure CLI example uses the az monitor data-collection rule create command.

    subscriptionId="aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
resourceGroupName="myResourceGroup"
dataCollectionRuleName="myDataCollectionRule"
ruleFile="./my-dcr.json"

az account set --subscription "$subscriptionId"
az extension add --name monitor-control-service

az monitor data-collection rule create \
  --resource-group "$resourceGroupName" \
  --name "$dataCollectionRuleName" \
  --rule-file "$ruleFile"

    Note

    Azure CLI commands use the Azure Resource Manager endpoint from the current CLI context, so management.azure.com doesn't need to be specified in the command syntax.


    Expand to view the my-dcr.json file. 
    {
  "location": "eastus",
  "kind": "Direct",
  "properties": {
    "streamDeclarations": {
      "Custom-myTable": {
        "columns": [
          {
            "name": "TimeGenerated",
            "type": "dateTime"
          },
          {
            "name": "StringProperty",
            "type": "string"
          },
          {
            "name": "IntProperty",
            "type": "int"
          },
          {
            "name": "LongProperty",
            "type": "long"
          },
          {
            "name": "RealProperty",
            "type": "real"
          },
          {
            "name": "BooleanProperty",
            "type": "boolean"
          },
          {
            "name": "GuidProperty",
            "type": "guid"
          },
          {
            "name": "DateTimeProperty",
            "type": "dateTime"
          }
        ]
      }
    },
    "destinations": {
      "logAnalytics": [
        {
          "workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace",
          "name": "myWorkspace"
        }
      ]
    },
    "dataFlows": [
      {
        "streams": [
          "Custom-myTable"
        ],
        "transformKql": "source",
        "destinations": [
          "myWorkspace"
        ],
        "outputStream": "Custom-myTable_CL"
      }
    ]
  }
}
    Variable Example value Purpose
    host management.azure.com Implicit ARM endpoint
    subscriptionId aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e User input
    resourceGroupName myResourceGroup User input
    dataCollectionRuleName myDataCollectionRule User input
    location eastus User input
    Custom-tableName Custom-myTable User input
    Custom-tableName_CL Custom-myTable_CL User input
    apiVersion 2025-07-01 Reference

  4. Grant your application permission to use your DCR.

  5. Send data using sample code.

Warning

When ingesting logs into the Auxiliary tier of Azure Monitor, avoid submitting a single payload that contains TimeGenerated timestamps that span more than 30 minutes in one API call. This API call might lead to the following ingestion error code RecordsTimeRangeIsMoreThan30Minutes. This is a known limitation that's getting removed.

This restriction does not apply to Auxiliary logs that use transformations.

Use a workspace transformation

For more information, see the following articles:

Related content

  • Last updated on