How to view failed requests when uploading data via log ingestion endpoint?

42726446 65

I've been following your tutorials on uploading data to a log analytics workspace:

However, I noticed that when I try to upload logs that do not exactly match the DCR's column definitions (through a DCE via the provided Python script), then I don't get an HttpResponseError in the Python script, but the logs never make it to the log analytics workspace.

Is there any way for me to check whether for errors in the DCE->DCR->workspace pipeline? Right now the only way for me to check whether I made a mistake is to wait for 10 minutes and if the logs don't show up, I probably did something wrong.

1 answer

Monalla-MSFT 13,031 Reputation points

2024-06-20T15:21:42.7333333+00:00
@42726446 - Welcome to Microsoft Q&A and thanks for reaching out to us.

When you send data to a Log Analytics workspace through a DCR, the data must match the schema defined in the DCR. If the data does not match the schema, it will not be ingested into the workspace.

To check for errors in the pipeline, you can use the Azure Monitor Logs REST API to query the Operation table in your workspace. It contains error messages and warnings that occur in your workspace. You can create alerts for issues with the level of Warning and Error.

Here is an example of how to query the Operation table using the Azure Monitor Logs REST API:

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query Content-Type: application/json Authorization: Bearer {token} { "query": "Operation | where TimeGenerated > ago(1d) | project TimeGenerated, Category, Operation, Level, Detail" }

Replace {workspaceId} with the ID of your workspace and {token} with an Azure AD access token that has the Log Analytics Reader role for your workspace.

This query will return all the records in the Operation table for the last day. You can modify the query to filter for specific categories or levels of issues.

Hope this helps. and please feel free to reach out if you have any further questions.

Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.
Please sign in to rate this answer.
42726446 65 Reputation points

2024-06-21T09:03:02.56+00:00

This answer does not seem to be correct. I tried to upload logs with the wrong format and as expected, they never reached the log analysis workspace. I ran the following command and the query returned 0 results ("rows": []):

az rest --method post \ --url https://api.loganalytics.io/v1/workspaces/108faf69-d68f-4096-9bd5-7ce408ea635d/query \ --headers "Content-Type=application/json" \ --body '{ "query": "Operation | where TimeGenerated > ago(1d) " }'

The logged-in user is an admin and has access to the table. I got the workspace ID from the properties blade of my log analytics workspace.

Note: I didn't use the projection you provided because I got the following error when I tried to include it:

Bad Request({"error":{"message":"The request had some invalid properties","code":"BadArgumentError","correlationId":"41bf3acc-2330-4a10-a63e-9b852f56a906","innererror":{"code":"SemanticError","message":"A semantic error occurred.","innererror":{"code":"SEM0100","message":"'project' operator: Failed to resolve scalar expression named 'Category'"}}}})

42726446 65 Reputation points

2024-06-21T09:06:02.2666667+00:00

Your answer did not seem to work. I uploaded data in the wrong format and waited for 10 minutes, the data did not reach the workspace. I then ran the following query and got zero results ("rows": []):

az rest --method post \ --url https://api.loganalytics.io/v1/workspaces/108faf69-d68f-4096-9bd5-7ce408ea635d/query \ --headers "Content-Type=application/json" \ --body '{ "query": "Operation | where TimeGenerated > ago(1d) " }'

The user I used was a logged-in admin, it has access to the table. The workspace itself works, since when I tried to upload correctly formatted data, it reached the workspace successfully. I got the workspace ID from the properties blade in my log analytics workspace.

Note: I didn't use the project you provided in your query because it resulted in an error:

Bad Request({"error":{"message":"The request had some invalid properties","code":"BadArgumentError","correlationId":"41bf3acc-2330-4a10-a63e-9b852f56a906","innererror":{"code":"SemanticError","message":"A semantic error occurred.","innererror":{"code":"SEM0100","message":"'project' operator: Failed to resolve scalar expression named 'Category'"}}}})

42726446 65 Reputation points

2024-07-15T11:53:19.86+00:00

@Monalla-MSFT Could you please let me know how I can continue? The query you showed did not seem to work.

42726446 65 Reputation points

2024-07-17T09:11:44.8633333+00:00

I'm currently facing a situation where I'm trying to upload two log entries and only one is reaching the table.

I would like to debug what's going wrong so I tried the command without the TimeGenerated > ago(1d) but the table is empty.

Command I tried:

az rest --method post --url https://api.loganalytics.io/v1/workspaces/8220a034-afc4-4636-956c-f749fe4ac478/query --headers "Content-Type=application/json" --body '{ "query": "Operation " }'

42726446 65 Reputation points

2024-07-17T09:14:41.01+00:00

I'm currently dealing with a situation where my log file contains two log entries, but only one of them is being uploaded. I need to debug what's going wrong. I thought maybe it would work if I removed the TimeGenerated > ago(1d) part but no dice, the result I get back still contains no rows.

Command:

az rest --method post --url https://api.loganalytics.io/v1/workspaces/8220a034-afc4-4636-956c-f749fe4ac478/query --headers "Content-Type=application/json" --body '{ "query": "Operation " }'

@Monalla-MSFT could you please help?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to view failed requests when uploading data via log ingestion endpoint?

1 answer

Your answer