Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Bicep resource definition
The dataCollectionRules resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.Insights/dataCollectionRules resource, add the following Bicep to your template.
resource symbolicname 'Microsoft.Insights/dataCollectionRules@2021-04-01' = {
kind: 'string'
location: 'string'
name: 'string'
properties: {
dataFlows: [
{
destinations: [
'string'
]
streams: [
'string'
]
}
]
dataSources: {
extensions: [
{
extensionName: 'string'
extensionSettings: any(...)
inputDataSources: [
'string'
]
name: 'string'
streams: [
'string'
]
}
]
performanceCounters: [
{
counterSpecifiers: [
'string'
]
name: 'string'
samplingFrequencyInSeconds: int
streams: [
'string'
]
}
]
syslog: [
{
facilityNames: [
'string'
]
logLevels: [
'string'
]
name: 'string'
streams: [
'string'
]
}
]
windowsEventLogs: [
{
name: 'string'
streams: [
'string'
]
xPathQueries: [
'string'
]
}
]
}
description: 'string'
destinations: {
azureMonitorMetrics: {
name: 'string'
}
logAnalytics: [
{
name: 'string'
workspaceResourceId: 'string'
}
]
}
}
tags: {
{customized property}: 'string'
}
}
Property Values
Microsoft.Insights/dataCollectionRules
Name | Description | Value |
---|---|---|
kind | The kind of the resource. | 'Linux' 'Windows' |
location | The geo-location where the resource lives. | string (required) |
name | The resource name | string (required) |
properties | Resource properties. | DataCollectionRuleResourceProperties |
tags | Resource tags | Dictionary of tag names and values. See Tags in templates |
DataCollectionRuleDataSources
Name | Description | Value |
---|---|---|
extensions | The list of Azure VM extension data source configurations. | ExtensionDataSource[] |
performanceCounters | The list of performance counter data source configurations. | PerfCounterDataSource[] |
syslog | The list of Syslog data source configurations. | SyslogDataSource[] |
windowsEventLogs | The list of Windows Event Log data source configurations. | WindowsEventLogDataSource[] |
DataCollectionRuleDestinations
Name | Description | Value |
---|---|---|
azureMonitorMetrics | Azure Monitor Metrics destination. | DestinationsSpecAzureMonitorMetrics |
logAnalytics | List of Log Analytics destinations. | LogAnalyticsDestination[] |
DataCollectionRuleResourceProperties
Name | Description | Value |
---|---|---|
dataFlows | The specification of data flows. | DataFlow[] |
dataSources | The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint. |
DataCollectionRuleDataSources |
description | Description of the data collection rule. | string |
destinations | The specification of destinations. | DataCollectionRuleDestinations |
DataCollectionRuleResourceTags
Name | Description | Value |
---|
DataFlow
Name | Description | Value |
---|---|---|
destinations | List of destinations for this data flow. | string[] |
streams | List of streams for this data flow. | String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent' |
DestinationsSpecAzureMonitorMetrics
Name | Description | Value |
---|---|---|
name | A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule. |
string |
ExtensionDataSource
Name | Description | Value |
---|---|---|
extensionName | The name of the VM extension. | string (required) |
extensionSettings | The extension settings. The format is specific for particular extension. | any |
inputDataSources | The list of data sources this extension needs data from. | string[] |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent' |
LogAnalyticsDestination
Name | Description | Value |
---|---|---|
name | A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule. |
string |
workspaceResourceId | The resource ID of the Log Analytics workspace. | string |
PerfCounterDataSource
Name | Description | Value |
---|---|---|
counterSpecifiers | A list of specifier names of the performance counters you want to collect. Use a wildcard (*) to collect a counter for all instances. To get a list of performance counters on Windows, run the command 'typeperf'. |
string[] |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
samplingFrequencyInSeconds | The number of seconds between consecutive counter measurements (samples). | int |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-InsightsMetrics' 'Microsoft-Perf' |
SyslogDataSource
Name | Description | Value |
---|---|---|
facilityNames | The list of facility names. | String array containing any of: '*' 'alert' 'audit' 'auth' 'authpriv' 'clock' 'cron' 'daemon' 'ftp' 'kern' 'local0' 'local1' 'local2' 'local3' 'local4' 'local5' 'local6' 'local7' 'lpr' 'mail' 'mark' 'news' 'nopri' 'ntp' 'syslog' 'user' 'uucp' |
logLevels | The log levels to collect. | String array containing any of: '*' 'Alert' 'Critical' 'Debug' 'Emergency' 'Error' 'Info' 'Notice' 'Warning' |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Syslog' |
WindowsEventLogDataSource
Name | Description | Value |
---|---|---|
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Event' 'Microsoft-WindowsEvent' |
xPathQueries | A list of Windows Event Log queries in XPATH format. | string[] |
Usage Examples
Azure Verified Modules
The following Azure Verified Modules can be used to deploy this resource type.
Module | Description |
---|---|
Data Collection Rule | AVM Resource Module for Data Collection Rule |
Azure Quickstart Samples
The following Azure Quickstart templates contain Bicep samples for deploying this resource type.
Bicep File | Description |
---|---|
Deploy Secure AI Foundry with a managed virtual network | This template creates a secure Azure AI Foundry environment with robust network and identity security restrictions. |
ARM template resource definition
The dataCollectionRules resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.Insights/dataCollectionRules resource, add the following JSON to your template.
{
"type": "Microsoft.Insights/dataCollectionRules",
"apiVersion": "2021-04-01",
"name": "string",
"kind": "string",
"location": "string",
"properties": {
"dataFlows": [
{
"destinations": [ "string" ],
"streams": [ "string" ]
}
],
"dataSources": {
"extensions": [
{
"extensionName": "string",
"extensionSettings": {},
"inputDataSources": [ "string" ],
"name": "string",
"streams": [ "string" ]
}
],
"performanceCounters": [
{
"counterSpecifiers": [ "string" ],
"name": "string",
"samplingFrequencyInSeconds": "int",
"streams": [ "string" ]
}
],
"syslog": [
{
"facilityNames": [ "string" ],
"logLevels": [ "string" ],
"name": "string",
"streams": [ "string" ]
}
],
"windowsEventLogs": [
{
"name": "string",
"streams": [ "string" ],
"xPathQueries": [ "string" ]
}
]
},
"description": "string",
"destinations": {
"azureMonitorMetrics": {
"name": "string"
},
"logAnalytics": [
{
"name": "string",
"workspaceResourceId": "string"
}
]
}
},
"tags": {
"{customized property}": "string"
}
}
Property Values
Microsoft.Insights/dataCollectionRules
Name | Description | Value |
---|---|---|
apiVersion | The api version | '2021-04-01' |
kind | The kind of the resource. | 'Linux' 'Windows' |
location | The geo-location where the resource lives. | string (required) |
name | The resource name | string (required) |
properties | Resource properties. | DataCollectionRuleResourceProperties |
tags | Resource tags | Dictionary of tag names and values. See Tags in templates |
type | The resource type | 'Microsoft.Insights/dataCollectionRules' |
DataCollectionRuleDataSources
Name | Description | Value |
---|---|---|
extensions | The list of Azure VM extension data source configurations. | ExtensionDataSource[] |
performanceCounters | The list of performance counter data source configurations. | PerfCounterDataSource[] |
syslog | The list of Syslog data source configurations. | SyslogDataSource[] |
windowsEventLogs | The list of Windows Event Log data source configurations. | WindowsEventLogDataSource[] |
DataCollectionRuleDestinations
Name | Description | Value |
---|---|---|
azureMonitorMetrics | Azure Monitor Metrics destination. | DestinationsSpecAzureMonitorMetrics |
logAnalytics | List of Log Analytics destinations. | LogAnalyticsDestination[] |
DataCollectionRuleResourceProperties
Name | Description | Value |
---|---|---|
dataFlows | The specification of data flows. | DataFlow[] |
dataSources | The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint. |
DataCollectionRuleDataSources |
description | Description of the data collection rule. | string |
destinations | The specification of destinations. | DataCollectionRuleDestinations |
DataCollectionRuleResourceTags
Name | Description | Value |
---|
DataFlow
Name | Description | Value |
---|---|---|
destinations | List of destinations for this data flow. | string[] |
streams | List of streams for this data flow. | String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent' |
DestinationsSpecAzureMonitorMetrics
Name | Description | Value |
---|---|---|
name | A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule. |
string |
ExtensionDataSource
Name | Description | Value |
---|---|---|
extensionName | The name of the VM extension. | string (required) |
extensionSettings | The extension settings. The format is specific for particular extension. | any |
inputDataSources | The list of data sources this extension needs data from. | string[] |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent' |
LogAnalyticsDestination
Name | Description | Value |
---|---|---|
name | A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule. |
string |
workspaceResourceId | The resource ID of the Log Analytics workspace. | string |
PerfCounterDataSource
Name | Description | Value |
---|---|---|
counterSpecifiers | A list of specifier names of the performance counters you want to collect. Use a wildcard (*) to collect a counter for all instances. To get a list of performance counters on Windows, run the command 'typeperf'. |
string[] |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
samplingFrequencyInSeconds | The number of seconds between consecutive counter measurements (samples). | int |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-InsightsMetrics' 'Microsoft-Perf' |
SyslogDataSource
Name | Description | Value |
---|---|---|
facilityNames | The list of facility names. | String array containing any of: '*' 'alert' 'audit' 'auth' 'authpriv' 'clock' 'cron' 'daemon' 'ftp' 'kern' 'local0' 'local1' 'local2' 'local3' 'local4' 'local5' 'local6' 'local7' 'lpr' 'mail' 'mark' 'news' 'nopri' 'ntp' 'syslog' 'user' 'uucp' |
logLevels | The log levels to collect. | String array containing any of: '*' 'Alert' 'Critical' 'Debug' 'Emergency' 'Error' 'Info' 'Notice' 'Warning' |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Syslog' |
WindowsEventLogDataSource
Name | Description | Value |
---|---|---|
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Event' 'Microsoft-WindowsEvent' |
xPathQueries | A list of Windows Event Log queries in XPATH format. | string[] |
Usage Examples
Azure Quickstart Templates
The following Azure Quickstart templates deploy this resource type.
Template | Description |
---|---|
Data Collection Rule for Syslog |
This template creates a data collection rule defining the data source (Syslog) and the destination workspace. |
Deploy Darktrace Autoscaling vSensors |
This template allows you to deploy an automatically autoscaling deployment of Darktrace vSensors |
Deploy Secure AI Foundry with a managed virtual network |
This template creates a secure Azure AI Foundry environment with robust network and identity security restrictions. |
Terraform (AzAPI provider) resource definition
The dataCollectionRules resource type can be deployed with operations that target:
- Resource groups
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.Insights/dataCollectionRules resource, add the following Terraform to your template.
resource "azapi_resource" "symbolicname" {
type = "Microsoft.Insights/dataCollectionRules@2021-04-01"
name = "string"
parent_id = "string"
location = "string"
tags = {
{customized property} = "string"
}
body = {
kind = "string"
properties = {
dataFlows = [
{
destinations = [
"string"
]
streams = [
"string"
]
}
]
dataSources = {
extensions = [
{
extensionName = "string"
extensionSettings = ?
inputDataSources = [
"string"
]
name = "string"
streams = [
"string"
]
}
]
performanceCounters = [
{
counterSpecifiers = [
"string"
]
name = "string"
samplingFrequencyInSeconds = int
streams = [
"string"
]
}
]
syslog = [
{
facilityNames = [
"string"
]
logLevels = [
"string"
]
name = "string"
streams = [
"string"
]
}
]
windowsEventLogs = [
{
name = "string"
streams = [
"string"
]
xPathQueries = [
"string"
]
}
]
}
description = "string"
destinations = {
azureMonitorMetrics = {
name = "string"
}
logAnalytics = [
{
name = "string"
workspaceResourceId = "string"
}
]
}
}
}
}
Property Values
Microsoft.Insights/dataCollectionRules
Name | Description | Value |
---|---|---|
kind | The kind of the resource. | 'Linux' 'Windows' |
location | The geo-location where the resource lives. | string (required) |
name | The resource name | string (required) |
properties | Resource properties. | DataCollectionRuleResourceProperties |
tags | Resource tags | Dictionary of tag names and values. |
type | The resource type | "Microsoft.Insights/dataCollectionRules@2021-04-01" |
DataCollectionRuleDataSources
Name | Description | Value |
---|---|---|
extensions | The list of Azure VM extension data source configurations. | ExtensionDataSource[] |
performanceCounters | The list of performance counter data source configurations. | PerfCounterDataSource[] |
syslog | The list of Syslog data source configurations. | SyslogDataSource[] |
windowsEventLogs | The list of Windows Event Log data source configurations. | WindowsEventLogDataSource[] |
DataCollectionRuleDestinations
Name | Description | Value |
---|---|---|
azureMonitorMetrics | Azure Monitor Metrics destination. | DestinationsSpecAzureMonitorMetrics |
logAnalytics | List of Log Analytics destinations. | LogAnalyticsDestination[] |
DataCollectionRuleResourceProperties
Name | Description | Value |
---|---|---|
dataFlows | The specification of data flows. | DataFlow[] |
dataSources | The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint. |
DataCollectionRuleDataSources |
description | Description of the data collection rule. | string |
destinations | The specification of destinations. | DataCollectionRuleDestinations |
DataCollectionRuleResourceTags
Name | Description | Value |
---|
DataFlow
Name | Description | Value |
---|---|---|
destinations | List of destinations for this data flow. | string[] |
streams | List of streams for this data flow. | String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent' |
DestinationsSpecAzureMonitorMetrics
Name | Description | Value |
---|---|---|
name | A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule. |
string |
ExtensionDataSource
Name | Description | Value |
---|---|---|
extensionName | The name of the VM extension. | string (required) |
extensionSettings | The extension settings. The format is specific for particular extension. | any |
inputDataSources | The list of data sources this extension needs data from. | string[] |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent' |
LogAnalyticsDestination
Name | Description | Value |
---|---|---|
name | A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule. |
string |
workspaceResourceId | The resource ID of the Log Analytics workspace. | string |
PerfCounterDataSource
Name | Description | Value |
---|---|---|
counterSpecifiers | A list of specifier names of the performance counters you want to collect. Use a wildcard (*) to collect a counter for all instances. To get a list of performance counters on Windows, run the command 'typeperf'. |
string[] |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
samplingFrequencyInSeconds | The number of seconds between consecutive counter measurements (samples). | int |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-InsightsMetrics' 'Microsoft-Perf' |
SyslogDataSource
Name | Description | Value |
---|---|---|
facilityNames | The list of facility names. | String array containing any of: '*' 'alert' 'audit' 'auth' 'authpriv' 'clock' 'cron' 'daemon' 'ftp' 'kern' 'local0' 'local1' 'local2' 'local3' 'local4' 'local5' 'local6' 'local7' 'lpr' 'mail' 'mark' 'news' 'nopri' 'ntp' 'syslog' 'user' 'uucp' |
logLevels | The log levels to collect. | String array containing any of: '*' 'Alert' 'Critical' 'Debug' 'Emergency' 'Error' 'Info' 'Notice' 'Warning' |
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Syslog' |
WindowsEventLogDataSource
Name | Description | Value |
---|---|---|
name | A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule. |
string |
streams | List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to. |
String array containing any of: 'Microsoft-Event' 'Microsoft-WindowsEvent' |
xPathQueries | A list of Windows Event Log queries in XPATH format. | string[] |