This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 65%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Below issue is fixed in the latest version of Custom Log integration.
Hello,
I have followed this document to implement the Custom Log integration with log analytics from multiple VMs.
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log
Its working fine. But i'm not able to distinguish the logs between Multiple VMs. Is there any way to add column called "hostname" or "vm_name" from Custom Logs integration? I know I can add hostname to application logs and it can be parsed at Log Analytics workspace to distinguish it. But I'm looking for a way to configure this at Custom Logs Integration.
And also I can see "_ResourceId" field in the custom log table but it was not populated with Hostname/VM Name.
I am not certain if many here will have tried this option yet. No labs to compare. You might need to share more info, possibly a screen shot or run getschema. That resource ID might just be the workspace ID. I can try to share your feedback if you think something is missing.
More Information as requested:
Once DCR(Data Collection Rules) was created , we need to associate the DCR with the actual VMs as mentioned here:
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log#create-association-with-agent
Once it was associated, logs from the VM will be ingested into the Log Analytics workspace. So far no issues. Lets say If i want to collect logs from one more VM, I will associate that DCR again with one more VM. Now logs of BOTH VMs are ingested into same Log Analytics workspace's custom table. So its difficult to find which logs are from which VM.
So I'm asking is there any way to add hostname/vm_name field in the custom table, so we will able to differentiate the logs easily.
If you see the above image, _ResourceId is empty. I thought this will be populated with Azure Resource ID and i can differentiate between the VMs. But not the case here.
Added more information to the question.
This issue is fixed in latest version of Custom Log integration. Now I'm able to see the Source VM in the _ResourceId column.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 93%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Hi,
I'm facing the same problem. Using the OMS (Log Analytics) agent, I can collect log files in Linux VM's and there's a column named "Computer" which identifies the origin VM name for each log line. Which is what is needed.
When using the AMA agent, there's no Computer column.
In fact, the only columns I see are TimeGenerate, RawData, TenantId and Type.
I've tried to add the Computer column in the table definition and also in the DCR, but it has no effect. This seems to need to be hard-coded in the agent itself (for example, the TenantId string can be found in the agent binary, so clearly that's something the agent checks within the VM and adds to the data sent to the LAW)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 21%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECS%3C/text%3E%3C/svg%3E)
Having the exact same Issue, tried logging a support request through Azure. They couldn't help and told me to post on the forum and a "Log Analytics Expert" would respond within 24hrs...
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 80%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIR%3C/text%3E%3C/svg%3E)
Greetings CodyS-3340,
My name is Irfan Rabbani and I work with Azure Monitor Agent Support as a Service Technical Advisor.
Please accept our humble apology for the overall support experience you received in your last engagement.
At Microsoft we aspire to empower our customers to achieve more, and I would like to take the opportunity to learn from this engagement
I have shared your feedback with support leadership as an opportunity to provide more coaching in support communication improvement.
I checked with the product group and learned that this behavior for the current preview is in the process of being fixed.
Unfortunately, I don't have ETA on the Fix release, but I want to make sure you and rest of the respected community is aware that we are working on it along with other improvements on Collect text and IIS logs with Azure Monitor agent (preview).
Sincerely,
Irfan Rabbani
Greetings Codey, can you please confirm this issue is resolved? I learned from Pg that fix for this is being deployed.
Best Regards,
Irfan Rabbani
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 88%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZ%3C/text%3E%3C/svg%3E)
Hi, I'm experiencing the same issue, altough I use windows VMSS.
I have the same issue with IIS and custom Logs as well, in the Log Analytics Workspace I see the logs, but the "Computer" field is blank.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 16%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKV%3C/text%3E%3C/svg%3E)
@Irfan Rabbani , Any updates here for fixing this issue?
Current Setup :
In the RawData of my CustomTable, I can view the anticipated text log. However, both the Computer and _ResourceID columns are devoid of information. This makes it challenging for me to distinguish which VM the logs are associated with.
Greetings Kumar, Thanks for reaching out. What is version of AMA agent you are using when observing this issue? It appears that an agent release back in Jan,2023 for AMA Agents we had fixed for this https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-extension-versions#version-details .I assume you are using AMA agents when observing this issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 6%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJH%3C/text%3E%3C/svg%3E)
If the name of the computer is in another field, such as the resource ID then you can use a source transformation on the DCR. You'll need to modify the custom table to ensure it has the right field first and have the ability to craft your own KQL to extract the value.
You can find the documentation for a similar process here:
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-transformation
If I wanted to extract the VM name or Arc server name from the resource ID the transform might look something like this:
source | extend Computer = extract("(?:virtualMachines|machines)/(.+)$",1,_ResourceId)