The following sample script creates a workspace with no data source configuration.
$ResourceGroup = <"my-resource-group">
$WorkspaceName = <"log-analytics-workspace-name">
$Location = <"westeurope">
# Create the resource group if needed
try {
Get-AzResourceGroup -Name $ResourceGroup -ErrorAction Stop
} catch {
New-AzResourceGroup -Name $ResourceGroup -Location $Location
}
# Create the workspace
New-AzOperationalInsightsWorkspace -Location $Location -Name $WorkspaceName -ResourceGroupName $ResourceGroup
Note
Log Analytics was previously called Operational Insights. The PowerShell cmdlets use Operational Insights in Log Analytics commands.
After you've created a workspace, configure a Log Analytics workspace in Azure Monitor by using PowerShell.
The following sample uses Microsoft.OperationalInsights workspaces to create a Log Analytics workspace in Azure Monitor. For more information about Bicep, see Bicep overview.
Note
See Azure Resource Manager samples for Azure Monitor for a list of samples that are available and guidance on deploying them in your Azure subscription.
@description('Name of the workspace.')
param workspaceName string
@description('Pricing tier: PerGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers.')
@allowed([
'pergb2018'
'Free'
'Standalone'
'PerNode'
'Standard'
'Premium'
])
param sku string = 'pergb2018'
@description('Specifies the location for the workspace.')
param location string
@description('Number of days to retain data.')
param retentionInDays int = 120
@description('true to use resource or workspace permissions. false to require workspace permissions.')
param resourcePermissions bool
@description('Number of days to retain data in Heartbeat table.')
param heartbeatTableRetention int
resource workspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
name: workspaceName
location: location
properties: {
sku: {
name: sku
}
retentionInDays: retentionInDays
features: {
enableLogAccessUsingOnlyResourcePermissions: resourcePermissions
}
}
}
resource workspaceName_Heartbeat 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
parent: workspace
name: 'Heartbeat'
properties: {
retentionInDays: heartbeatTableRetention
}
}
Note
If you specify a pricing tier of Free, then remove the retentionInDays element.
using './main.bicep'
param workspaceName = 'MyWorkspace'
param sku = 'pergb2018'
param location = 'eastus'
param retentionInDays = 120
param resourcePermissions = true
param heartbeatTableRetention = 30
The following sample uses the Microsoft.OperationalInsights workspaces template to create a Log Analytics workspace in Azure Monitor.
For more information about Azure Resource Manager templates, see Azure Resource Manager templates.
Note
See Azure Resource Manager samples for Azure Monitor for a list of samples that are available and guidance on deploying them in your Azure subscription.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspaceName": {
"type": "string",
"metadata": {
"description": "Name of the workspace."
}
},
"sku": {
"type": "string",
"defaultValue": "pergb2018",
"allowedValues": [
"pergb2018",
"Free",
"Standalone",
"PerNode",
"Standard",
"Premium"
],
"metadata": {
"description": "Pricing tier: PerGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
}
},
"location": {
"type": "string",
"metadata": {
"description": "Specifies the location for the workspace."
}
},
"retentionInDays": {
"type": "int",
"defaultValue": 120,
"metadata": {
"description": "Number of days to retain data."
}
},
"resourcePermissions": {
"type": "bool",
"metadata": {
"description": "true to use resource or workspace permissions. false to require workspace permissions."
}
},
"heartbeatTableRetention": {
"type": "int",
"metadata": {
"description": "Number of days to retain data in Heartbeat table."
}
}
},
"resources": [
{
"type": "Microsoft.OperationalInsights/workspaces",
"apiVersion": "2023-09-01",
"name": "[parameters('workspaceName')]",
"location": "[parameters('location')]",
"properties": {
"sku": {
"name": "[parameters('sku')]"
},
"retentionInDays": "[parameters('retentionInDays')]",
"features": {
"enableLogAccessUsingOnlyResourcePermissions": "[parameters('resourcePermissions')]"
}
}
},
{
"type": "Microsoft.OperationalInsights/workspaces/tables",
"apiVersion": "2022-10-01",
"name": "[format('{0}/{1}', parameters('workspaceName'), 'Heartbeat')]",
"properties": {
"retentionInDays": "[parameters('heartbeatTableRetention')]"
},
"dependsOn": [
"workspace"
]
}
]
}
Note
If you specify a pricing tier of Free, then remove the retentionInDays element.
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspaceName": {
"value": "MyWorkspace"
},
"sku": {
"value": "pergb2018"
},
"location": {
"value": "eastus"
},
"resourcePermissions": {
"value": true
},
"heartbeatTableRetention": {
"value": 30
}
}
}