Cannot seem to connect log analytics to my exported json logs residing in a storage account insights-logs-signinlogs

Akr ofly 256

I am attempting to query my json files using log analytics. This concerns the insights-logs-signinlogs that are residing in a storage account. They have been exported via a configured diagnistic settings.

When changing the scope in log analytics to point to the storage account the list seems show the resources in the left pane.

I cannot seem to be able to retreive anything from the resouce labeled "StorageBlobLogs". The error received is: Failed to resolve table or column expression named 'StorageBlobLogs'

When I click the StorageBlobLogs resource and choose preview data I receive "Error retrieving data"

I know the blob contains data since I am capable of connecting and downloading using PowerShell, the json files are there.

My desire here is to run KQL querries against the exported signin logs that reside within a Storage account.

Anyone has any idea as to what I am doing wrong?

bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-20T18:21:13.417+00:00

@Akr ofly - Welcome to Microsoft Q&A platform and thanks for using this forum. I am looking into this scenario and will get back to you at the earliest.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-24T00:24:48.667+00:00
@Akr ofly - Trying to understand your scenario here, please review and revert back. Thank you

You have enabled diagnostic settings for your AAD Sign-ins to send them to Storage Account

You are again sending storage blob logs to Log Analytics and trying to query StorageBlobLogs with in "LogManagement" solution

Please review the Storage Blob Service Logs Schema to understand the columns you need.

To avoid double hops, can you see the option of sending the AAD sign-ins to Log Analytics directly and query there instead.
Akr ofly 256 Reputation points

2020-08-24T09:07:45.537+00:00

Almost correct understanding of my setup.

You wrote "you are again sending Storage blob logs to Log Analytics".
I am not sending them, I am simply editing the log analytics Scope to reflect and point to the StorageBlobLogs.

After having done that, the Resources show up in the left pane and any attempt to query or access the StorageBlobLogs content Return an error, as seen in the Attached screen shot.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-25T06:13:47.02+00:00

@Akr ofly Thank you for providing additional information , will review it further and get back to you at the earliest.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-26T02:31:29.127+00:00

@Akr ofly - Can please help confirm that if you have already enrolled in the preview for viewing Azure storage logs in Azure Monitor , using this page. Even after successfully enrolling you are not seeing the storage logs in Log Analytics and seeing the above mentioned error with message "Error retrieving data" ?
Akr ofly 256 Reputation points

2020-08-26T09:03:47.15+00:00

Thank you for your response.
(The Storage account scope is not stated as Limited preview function)

It is my understanding that the URL you published pertains to the monitoring storage account data regarding storage account usage.

That is not what we are attempting here.
We are attempting to query audit and signin logs that have been streamed over to the Storage account using a diagnostic settings configuration.

We also use event hub but wish to have an isolated storage of the audit and signin logs to a storage account, this is where long term retention comes in.

The support center wishes to be able to query the logs streamed to the storage account without having to send them over to the log analytics workspace and thought a scope shift would help them achieve that.

So can I conclude that querying audit and signin logs stored in a storage account directly via editing the scope is not supported at this time ?
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-27T00:26:24.08+00:00

@Akr ofly Thanks a lot for circling back and giving additional context on the query you have. I am checking with our internal team to understand if the scenario you are looking for is possible or not. Will keep you updated as I hear more information. Thank you

Accepted answer

Oleg Ananiev (MSFT) 81 Reputation points Microsoft Employee

2020-08-27T20:57:50.64+00:00

There seems to be some confusion here.
By selecting a storage account, as your scope, you will be accessing Diagnostic Logs emitted for this storage account - these are used to monitor Storage (currently in private preview).
Log Analytics cannot (easily) query the data that is in external storage accounts. There are few (complex) tricks to do that, but before going there - why not simply ingest AAD data into Log Analytics (instead or in addition to Storage Account)?
Please sign in to rate this answer.

1 person found this answer helpful.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-27T22:11:44.357+00:00

@Oleg Ananiev (MSFT) Thank you for helping on the thread.

@Akr ofly Hope the above information shared by @Oleg Ananiev (MSFT) helps answer your query. Can you please review from your side and let us know if you have further queries. Thank you

Akr ofly 256 Reputation points

2020-08-28T06:08:20.633+00:00

Thank you for clarifying that matter.

We are already ingesting AAD data into Log Analytics with a retention of 365 days.
We are also streaming to a third party with a much Shorter retention.

The company has a policy to have a copy residing in a storage account where the retention is much longer.

Do you happen to have an updated method we could utilise to transport the json logs from the storrage account to Log Analytics in order to query ?

Olivia Leung 0 Reputation points

2023-07-26T23:40:50.1966667+00:00

We're having the same problems . Is there a defined solution for this yet ?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Cannot seem to connect log analytics to my exported json logs residing in a storage account insights-logs-signinlogs

0 additional answers

Your answer