This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 6%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJH%3C/text%3E%3C/svg%3E)
I have followed this article
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log?tabs=portal
To test ingestion of custom logs with AMA. I am even using the PowerShell script in the article to generate the log file monitored.
When I query the resulting data, there is no RawData field. Can anyone suggest what is going wrong?
Table Schema
Ingested data
Source log file
Hard to say from the information provided but I assume one of the steps was incorrect. Possibly the table creation command. I recommend trying again with a new table, looking closely for anything you may have overlooked.
I've created the table with the exact code in article twice, code below
$tableParams = @'
{
"properties": {
"schema": {
"name": "foo2_CL",
"columns": [
{
"name": "TimeGenerated",
"type": "DateTime"
},
{
"name": "RawData",
"type": "String"
}
]
}
}
}
'@
Invoke-AzRestMethod -Path "/subscriptions/d16e7cba-ec7a-4d39-b222-1d20c2405312/resourcegroups/mrResourceGroup/providers/microsoft.operationalinsights/workspaces/ac1-prd-acs-asw-001/tables/foo2_CL?api-version=2021-12-01-preview" -Method PUT -payload $tableParams
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 24%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELA%3C/text%3E%3C/svg%3E)
I am currently having the same issue in my environment. I followed these steps a few weeks ago, and everything is working. Now, none of my new Tables have RawData populating. I currently have a support ticket open. I'll update if I find anything out.
The issue in my case was that I had reused a table I had previously created and then deleted during testing. As soon as I used a table name that had never been used before everything worked perfectly.