How to backup Log Analytics Workspace logs to a blob?

Question

Hi,

How do I create an automatic backup of my Log Analytics Workspace Logs (by DataType/Table with some tables reaching 1TB) every X months?

And, if you can also share how to restore them (to a different workspace) for analysis later?

Thanks!

Answer 1

Hi, Gregorio

Depending on your use cases, you could configure the logs to be exported to an Azure Storage account and then when needed use Azure Data Factory to export them into Azure Data Explorer for analysis.

This article here is a great reference point: Integrate Azure Data Explorer for long-term log retention

It talks to Sentinel, but the concept is the same, keep only the most recent and relevant data that will be queried in Log Analytics, everything else gets archived.

Answer 2

@Gregorio Montaño You can use Logic Apps to export data from Log analytics workspace to storage account. You will have option to set the recurrence on how frequently the export should be done. For more information on how to do this, refer this article.

It's suggested that you can directly send your logs to storage account instead of storing them in log analytics workspace and then sending it to storage account. As this approach has lower latency compared to data export in Log Analytics. Also, you can query the data stored in storage account using Azure Data Explorer. Refer this for more information.