Set a table's log data plan to Basic or Analytics

Azure Monitor Logs offers two log data plans that let you reduce log ingestion and retention costs and take advantage of Azure Monitor's advanced features and analytics capabilities based on your needs:

• The default Analytics log data plan provides full analysis capabilities and makes log data available for queries, Azure Monitor features, such as alerts, and use by other services.
• The Basic log data plan lets you save on the cost of ingesting and storing high-volume verbose logs in your Log Analytics workspace for debugging, troubleshooting, and auditing, but not for analytics and alerts.

This article describes Azure Monitor's log data plans and explains how to configure the log data plan of the tables in your Log Analytics workspace.

Compare the Basic and Analytics log data plans

The following table summarizes the Basic and Analytics log data plans.

Category	Analytics	Basic
Ingestion	Regular ingestion cost.	Reduced ingestion cost.
Log queries	Full query capabilities No extra cost.	Basic query capabilities. Pay-per-use.
Retention	Configure retention from 30 days to two years.	Retention fixed at eight days. When you change an existing table's plan to Basic logs, Azure archives data that's more than eight days old but still within the table's original retention period.
Alerts	Supported.	Not supported.

Note

The Basic log data plan isn't available for workspaces in legacy pricing tiers.

When should I use Basic logs?

By default, all tables in your Log Analytics workspace are Analytics tables, and they're available for query and alerts.

Configure a table for Basic logs if:

• You don't require more than eight days of data retention for the table.

• You only require basic queries of the data using a limited version of the query language.

• The cost savings for data ingestion exceed the expected cost for any expected queries.

• The table supports Basic logs.

  These tables currently support Basic logs:

  Service	Table
  Active Directory	AADDomainServicesDNSAuditsGeneral AADDomainServicesDNSAuditsDynamicUpdates
  Application Insights	AppTraces
  Container Apps	ContainerAppConsoleLogs
  Container Insights	ContainerLogV2
  Container Apps Environments	AppEnvSpringAppConsoleLogs
  Communication Services	ACSCallAutomationIncomingOperations ACSCallAutomationMediaSummary ACSCallRecordingIncomingOperations ACSCallRecordingSummary ACSRoomsIncomingOperations
  Confidential Ledgers	CCFApplicationLogs
  Custom tables	All custom tables created with or migrated to the data collection rule (DCR)-based logs ingestion API.
  Data Manager for Energy	OEPDataplaneLogs
  Dedicated SQL Pool	SynapseSqlPoolSqlRequests SynapseSqlPoolRequestSteps SynapseSqlPoolExecRequests SynapseSqlPoolDmsWorkers SynapseSqlPoolWaits
  Dev Center	DevCenterDiagnosticLogs
  Data Transfer	DataTransferOperations
  Firewalls	AZFWFlowTrace
  Health Data	AHDSMedTechDiagnosticLogs
  Kubernetes services	AKSAudit AKSAuditAdmin AKSControlPlane
  Media Services	AMSLiveEventOperations AMSKeyDeliveryRequests AMSMediaAccountHealth AMSStreamingEndpointRequests
  Redis Cache Enterprise	REDConnectionEvents
  Sphere	ASCAuditLogs ASCDeviceEvents
  Storage	StorageBlobLogs StorageFileLogs StorageQueueLogs StorageTableLogs
  Storage Mover	StorageMoverJobRunLogs StorageMoverCopyLogsFailed StorageMoverCopyLogsTransferred
  Virtual Network Manager	AVNMNetworkGroupMembershipChange

Note

Tables created with the Data Collector API don't support Basic logs.

Set a table's log data plan

You can switch a table's plan once a week.

Portal

To configure a table for Basic logs or Analytics logs in the Azure portal:

1. From the Log Analytics workspaces menu, select Tables.

   The Tables screen lists all the tables in the workspace.

2. Select the context menu for the table you want to configure and select Manage table.

   

3. From the Table plan dropdown on the table configuration screen, select Basic or Analytics.

   The Table plan dropdown is enabled only for tables that support Basic logs.

   

4. Select Save.

API

To configure a table for Basic logs or Analytics logs, call the Tables - Update API:

PATCH https://management.azure.com/subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/tables/<tableName>?api-version=2021-12-01-preview

Important

Use the bearer token for authentication. Learn more about using bearer tokens.

Request body

Name	Type	Description
properties.plan	string	The table plan. Possible values are Analytics and Basic.

Example

This example configures the ContainerLogV2 table for Basic logs.

Container insights uses ContainerLog by default. To switch to using ContainerLogV2 for Container insights, enable the ContainerLogV2 schema before you convert the table to Basic logs.

Sample request

PATCH https://management.azure.com/subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace/tables/ContainerLogV2?api-version=2021-12-01-preview

Use this request body to change to Basic logs:

{
    "properties": {
        "plan": "Basic"
    }
}

Use this request body to change to Analytics Logs:

{
    "properties": {
        "plan": "Analytics"
    }
}

Sample response

This sample is the response for a table changed to Basic logs:

Status code: 200

{
    "properties": {
        "retentionInDays": 8,
        "totalRetentionInDays": 30,
        "archiveRetentionInDays": 22,
        "plan": "Basic",
        "lastPlanModifiedDate": "2022-01-01T14:34:04.37",
        "schema": {...}        
    },
    "id": "subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace",
    "name": "ContainerLogV2"
}

CLI

To configure a table for Basic logs or Analytics logs, run the az monitor log-analytics workspace table update command and set the --plan parameter to Basic or Analytics.

For example:

• To set Basic logs:

  az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLogV2  --plan Basic
  

• To set Analytics Logs:

  az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLogV2  --plan Analytics
  

PowerShell

To configure a table's log data plan, use the Update-AzOperationalInsightsTable cmdlet:

Update-AzOperationalInsightsTable  -ResourceGroupName RG-NAME -WorkspaceName WORKSPACE-NAME -Plan Basic|Analytics

Next steps

• View table properties
• Set retention and archive policies
• Query data in Basic logs