Set a table's log data plan to Basic or Analytics
Azure Monitor Logs offers two log data plans that let you reduce log ingestion and retention costs and take advantage of Azure Monitor's advanced features and analytics capabilities based on your needs:
- The default Analytics log data plan provides full analysis capabilities and makes log data available for queries, Azure Monitor features, such as alerts, and use by other services.
- The Basic log data plan lets you save on the cost of ingesting and storing high-volume verbose logs in your Log Analytics workspace for debugging, troubleshooting, and auditing, but not for analytics and alerts.
This article describes Azure Monitor's log data plans and explains how to configure the log data plan of the tables in your Log Analytics workspace.
To set a table's log data plan, you must have at least contributor rights.
Compare the Basic and Analytics log data plans
The following table summarizes the Basic and Analytics log data plans.
|Ingestion||Regular ingestion cost.||Reduced ingestion cost.|
|Log queries||Full query capabilities
No extra cost.
|Basic query capabilities.
|Retention||Configure retention from 30 days to two years.||Retention fixed at eight days.
When you change an existing table's plan to Basic logs, Azure archives data that's more than eight days old but still within the table's original retention period.
The Basic log data plan isn't available for workspaces in legacy pricing tiers.
When should I use Basic logs?
By default, all tables in your Log Analytics workspace are Analytics tables, and they're available for query and alerts.
Configure a table for Basic logs if:
- You don't require more than eight days of data retention for the table.
- You only require basic queries of the data using a limited version of the query language.
- The cost savings for data ingestion exceed the expected cost for any expected queries.
- The table supports Basic logs.
Set a table's log data plan
When you change a table's plan from Analytics to Basic, Log Analytics immediately archives any data that's older than eight days and up to original data retention of the table. In other words, the total retention period of the table remains unchanged, unless you explicitly modify the archive period.
When you change a table's plan from Basic to Analytics, the changes take affect on existing data in the table immediately.
You can switch a table's plan once a week.
To configure a table for Basic logs or Analytics logs in the Azure portal:
From the Log Analytics workspaces menu, select Tables.
The Tables screen lists all the tables in the workspace.
Select the context menu for the table you want to configure and select Manage table.
From the Table plan dropdown on the table configuration screen, select Basic or Analytics.
The Table plan dropdown is enabled only for tables that support Basic logs.
These tables currently support Basic logs:
All custom tables created with or migrated to the data collection rule (DCR)-based logs ingestion API..
Tables created with the Data Collector API don't support Basic logs.