Metadata in Logs Analytics Workspace

Skolimowski Daniel (BD/XDP5) 0 Reputation points
2023-04-25T12:20:15.3133333+00:00

I am wondering is such scenario possible: Blob Storage Gen 2

----container

--------file

--------metadata: "key": "value"

The logs are configured and sent to Azure Logs Analytics Workspace. Is there any chance to read the metadata by writing a specific query in Logs Analytics Workspace? I want to have smth like this:

StorageBlobLogs |
 where (OperationName has "PutBlob" or OperationName has "GetBlob" or OperationName has "DeleteBlob")
 and TimeGenerated > ago(7d)
 | project OperationName, TimeGenerated, RequesterUpn, Uri , ObjectKey , AuthenticationType, MetaData

Please help.

Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
2,542 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Sedat SALMAN 13,265 Reputation points
    2023-04-28T06:12:38.5366667+00:00

    Azure Log Analytics does not support capturing metadata from Blob Storage directly. You can achieve this by using an Azure Function to process the Blob Storage logs and add the metadata to Log Analytics Workspace.

    Create an Azure Function with a Blob Storage trigger. In the Azure Function, read the blob logs generated by the Blob Storage actions (PutBlob, GetBlob, or DeleteBlob). You can parse the logs to extract the necessary information, such as OperationName, TimeGenerated, RequesterUpn, Uri, ObjectKey, and AuthenticationType. Use the Azure Storage SDK to read the metadata for the blobs in question. You can then include the metadata in your log entry. Use the Azure Monitor SDK to send the log entry, including the metadata, to your Log Analytics Workspace.

    after all you can write a kusto query like this

    customLogs_CL |
    where OperationName_s has "PutBlob" or OperationName_s has "GetBlob" or OperationName_s has "DeleteBlob"
    and TimeGenerated > ago(7d)
    | project OperationName_s, TimeGenerated, RequesterUpn_s, Uri_s, ObjectKey_s, AuthenticationType_s, MetaData_s
    
    0 comments No comments