Change Json structure on Azure Function log Archived into storage account

Question

Hello guys.. i have a huge problem with Azure Function log (on storage account) with Spring Framework + Log4j2 + JsonTemplate. As you can see, I've activated the log archive on the storage account (blob storage) from the Diagnostic Setting of my function:

and I correctly see these logs in .json files in the storage container:

This is my local log (with Spring and Log4j.xml + JsonTemplate):

{"timestamp":"2024-01-26T19:39:28.660Z","mdc":{ *** OBFUSCATED ***},"log.level":"INFO","message":"Message to log"}}","process.thread.name":"pool-2-thread-2","log.logger":"myLogger"}

but my logs on PT.json file on storage account are different, seems that are wrapped in a custom structure created by azure:

{
    "level": "Informational",
    "resourceId": "*** OBFUSCATED ***",
    "operationName": "Microsoft.Web/sites/functions/log",
    "category": "FunctionAppLogs",
    "time": "01/25/2024 13:56:56",
    "location": "*** OBFUSCATED ***",
    "properties": "{'appName':'myAppName','roleInstance':'*** OBFUSCATED ***','message':'the message that i see in local",
    "EventStampType": "Stamp",
    "EventPrimaryStampName": "*** OBFUSCATED ***",
    "EventStampName": "*** OBFUSCATED ***",
    "Host": "*** OBFUSCATED ***",
    "EventIpAddress": "*** OBFUSCATED ***"
}

So there is a way to log a custom structure into the storage json files or simply delete the azure overhead? In this way I can decide to log the same structure that I log locally (in order to index it correctly on Splunk).

Answer 1

Hello @Antonio M - Thanks for reaching out. The structure derives from the FunctionAppLogs table in Azure Monitor, and the diagnostic configuration in your screenshot above is a use of the data export feature of Log Analytics. To change structure and compose a new JSON with data points remapped differently, the guidance is to leverage Logic Apps: Export data from a Log Analytics workspace to a storage account by using Logic Apps

StackOverflow thread: https://stackoverflow.com/questions/77888749/change-json-structure-on-azure-function-log-archived-into-storage-account

---

Please "Accept Answer" if the answer is helpful so that others in the community may benefit from your experience.