How to migrate a CustomLog classic tables to DataCollectionRule based

Question

Hello,

I have several deployments in azure container instances, which I linked to a separate workspace in the azure monitor.
when creating the workspace, analytics logs are automatically used for all tables in the workspace. For azure container instances, there are two particular tables that I use for querying and troubleshooting container logs, and these are; (i) ContainerInstanceLog_CL and (ii) ContainerEvent_CL. Since these are primarily what gets ingested into the workspace.

I intend to switch to basic logs which is a more cost-effective approach for my use case, but when I try to update any of these two custom tables above, I get the error that is seen in the screenshot provided.

log analytics error.PNG

I have gone through the documentation, and haven't been able to find a direct way of migrating to Datacollectionrule based as suggested by azure.

is there a stated procedure or documentation for migration?

Please advise.

Answer 1

Hi Igoni, Joshua Thanks for posting your query on Microsoft Q&A.
The Basic log data plan lets you save on the cost of ingesting and storing high-volume verbose logs in your Log Analytics workspace for debugging, troubleshooting, and auditing, but is not for analytics and alerts.
This documentation provides detailed information on Basic Logs Data Plan.
Looking at the error message, it looks like your tables are not supported for Basic Logs.

To confirm, please check if you case falls under any of these limitations with Basic Logs:

• The Basic log data plan isn't available for workspaces in legacy pricing tiers.
• Tables created with the Data Collector API don't support Basic logs.
• Only these tables support Basic logs currently:
  Lastly, you can also verify if your table is supported for the basic plan by following the steps below via Azure Portal:
  Please check the documentation as well as limitations shared above and let me know the results. If you still need help on this, let me know in the comments and I can further investigate. Comments is the best way for me to get notified and get to you quicker.

---

If you have any questions at all, let me know in the comments.
If this helped, please 'Accept as Answer' so that it can improve discoverability for others in the community looking for help on the same topic.

Answer 2

Hi @Igoni, Joshua

Thanks for reaching Microsoft Q&A.

Regarding your request what you are looking for is on this link.

1. Configure your data collection rule (DCR) following procedures at Send custom logs to Azure Monitor Logs using Resource Manager templates or Add transformation in workspace data collection rule to Azure Monitor using resource manager templates.
2. If using the Logs ingestion API, also configure the data collection endpoint (DCE) and the agent or component that will be sending data to the API.
3. Issue the following API call against your table. This call is idempotent, so there will be no effect if the table has already been migrated. POST /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.operationalinsights/workspaces/{workspaceName}/tables/{tableName}/migrate?api-version=2021-03-01-privatepreview
4. Discontinue use of the Data Collector API and start using the new Logs ingestion API.

Hope this helps. Please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.