Metadata in Logs Analytics Workspace

Question

I am wondering is such scenario possible: Blob Storage Gen 2

----container

--------file

--------metadata: "key": "value"

The logs are configured and sent to Azure Logs Analytics Workspace. Is there any chance to read the metadata by writing a specific query in Logs Analytics Workspace? I want to have smth like this:

StorageBlobLogs |
 where (OperationName has "PutBlob" or OperationName has "GetBlob" or OperationName has "DeleteBlob")
 and TimeGenerated > ago(7d)
 | project OperationName, TimeGenerated, RequesterUpn, Uri , ObjectKey , AuthenticationType, MetaData

Please help.

Answer 1

Azure Log Analytics does not support capturing metadata from Blob Storage directly. You can achieve this by using an Azure Function to process the Blob Storage logs and add the metadata to Log Analytics Workspace.

Create an Azure Function with a Blob Storage trigger. In the Azure Function, read the blob logs generated by the Blob Storage actions (PutBlob, GetBlob, or DeleteBlob). You can parse the logs to extract the necessary information, such as OperationName, TimeGenerated, RequesterUpn, Uri, ObjectKey, and AuthenticationType. Use the Azure Storage SDK to read the metadata for the blobs in question. You can then include the metadata in your log entry. Use the Azure Monitor SDK to send the log entry, including the metadata, to your Log Analytics Workspace.

after all you can write a kusto query like this

customLogs_CL |
where OperationName_s has "PutBlob" or OperationName_s has "GetBlob" or OperationName_s has "DeleteBlob"
and TimeGenerated > ago(7d)
| project OperationName_s, TimeGenerated, RequesterUpn_s, Uri_s, ObjectKey_s, AuthenticationType_s, MetaData_s