Define what log level data is to be sent through Azure Arc to an Azure Log Analytics Workspace

Question

Hi,

I have Azure Arc installed on a Windows Server 2022 machine (on premise). On this machine there is a Java Spring application that I need to monitor, this application is writing logs to a rolling text file in a standard format, such as:

2024-05-16 14:08:54.351 WARN 4704 --- [ main] blablabla

I did all the setup required and sending logs to the Azure Log Analytics workspace is working fine, if I query it I can see the data flowing in, I only have one last question:

is there a way to tell Azure Arc to only send data based on a field? In this case, I would like to send data to the Azure Log Analytics Workspace only if the logging level is WARN or higher.

Thank you for your help.

AM

Answer 1

@AM - Welcome to Microsoft Q&A and thanks for reaching out to us.

You can configure log collection rules in AMA by defining what log level data is to be sent through Azure Arc to an Azure Log Analytics Workspace.

To configure log collection rules,

1. Navigate to your Azure Arc-enabled server in portal.
2. Click on the "Extensions" tab and select the "Azure Monitor Agent" extension.
3. Click on "Configuration Settings" and then "Edit".
4. In the "Data Collection" section, click on "Logs", and Add Filter and select "Custom Log".
5. Enter the path to your log file and select the appropriate log type in the "Custom log" section.
6. In the "Filter" section, enter the filter expression to match logs with a logging level of WARN or higher. For example, you can use the following filter expression: Level >= "WARN".
7. Click "Save" to save the log collection rule.

After you have configured the log collection rules, the AMA will only send logs to the Log Analytics workspace that match the specified filter expression. You can then use Log Analytics queries to analyze the logs and gain insights into your Java Spring application.

Hope this helps. and please feel free to reach out if you have any further questions.

---

Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.