Unable to leverage Auxiliary log table with Text or Json ingestion

Question

Hi, I have followed all the steps from this article https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-log-text?tabs=portal , and am able to ingest data into 'basic' logs. However if I try to use an 'Auxiliary' log table as destination, it errors out saying '{"code":"InvalidPayload","message":"Data collection rule is invalid","details":[{"code":"InvalidDataFlow","target":"properties.dataFlows[0]","message":"Stream (Custom-TextAux_CLRawData) cannot be transformed.Transformation not supported for Log analytics Auxiliary table destination xx-xx-xxxx"}]}' . The documentations for Auxiliary logs states that text/json as well as APi are supported methods (https://learn.microsoft.com/en-us/azure/azure-monitor/logs/create-custom-table-auxiliary) , but all seem to use transformation of some kind. How can one ingest data into an Auxiliary log table?

Answer 1

Hi Mehboob Ahmad

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

The error message means the stream you're using can't be transformed for an auxiliary table, usually because the data flow isn't set up correctly.

To resolve your issue, please follow the below steps

1.Make sure your auxiliary log table is set up to match the incoming data. You might need to create or update the table using PowerShell or Azure CLI to include the right columns, like TimeGenerated and RawData.

2.If you're sending raw text or JSON data, use a basic transformation that keeps the data as it is. This can help avoid issues with unsupported transformations.

3.When creating or updating your DCR, make sure to select the right options for data ingestion. For example, if using custom text logs, ensure the DCR handles the incoming data without extra transformations.

4.Start with a basic setup that just adds simple log entries to the Auxiliary table. Once it works, slowly add more complexity (like parsing fields) and watch for any errors.

If you have any further queries, do let us know.

---

If the answer is helpful, please click "Accept Answer" and "Upvote it".