Microsoft.Insights dataCollectionRules 2021-09-01-preview

Bicep resource definition

The dataCollectionRules resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/dataCollectionRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Insights/dataCollectionRules@2021-09-01-preview' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  }
  kind: 'string'
  properties: {
    dataCollectionEndpointId: 'string'
    dataFlows: [
      {
        destinations: [
          'string'
        ]
        outputStream: 'string'
        streams: [
          'string'
        ]
        transformKql: 'string'
      }
    ]
    dataSources: {
      extensions: [
        {
          extensionName: 'string'
          extensionSettings: any()
          inputDataSources: [
            'string'
          ]
          name: 'string'
          streams: [
            'string'
          ]
        }
      ]
      iisLogs: [
        {
          logDirectories: [
            'string'
          ]
          name: 'string'
          streams: [
            'string'
          ]
        }
      ]
      logFiles: [
        {
          filePatterns: [
            'string'
          ]
          format: 'text'
          name: 'string'
          settings: {
            text: {
              recordStartTimestampFormat: 'string'
            }
          }
          streams: [
            'string'
          ]
        }
      ]
      performanceCounters: [
        {
          counterSpecifiers: [
            'string'
          ]
          name: 'string'
          samplingFrequencyInSeconds: int
          streams: [
            'string'
          ]
        }
      ]
      syslog: [
        {
          facilityNames: [
            'string'
          ]
          logLevels: [
            'string'
          ]
          name: 'string'
          streams: 'Microsoft-Syslog'
        }
      ]
      windowsEventLogs: [
        {
          name: 'string'
          streams: [
            'string'
          ]
          xPathQueries: [
            'string'
          ]
        }
      ]
    }
    description: 'string'
    destinations: {
      azureMonitorMetrics: {
        name: 'string'
      }
      logAnalytics: [
        {
          name: 'string'
          workspaceResourceId: 'string'
        }
      ]
    }
    streamDeclarations: {
      {customized property}: {
        columns: [
          {
            name: 'string'
            type: 'string'
          }
        ]
      }
    }
  }
}

Property values

dataCollectionRules

Name Description Value
name The resource name string (required)
location The geo-location where the resource lives. string (required)
tags Resource tags. Dictionary of tag names and values. See Tags in templates
kind The kind of the resource. 'Linux'
'Windows'
properties Resource properties. DataCollectionRuleResourceProperties

DataCollectionRuleResourceProperties

Name Description Value
dataCollectionEndpointId The resource ID of the data collection endpoint that this rule can be used with. string
dataFlows The specification of data flows. DataFlow[]
dataSources The specification of data sources.
This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.
DataCollectionRuleDataSources
description Description of the data collection rule. string
destinations The specification of destinations. DataCollectionRuleDestinations
streamDeclarations Declaration of custom streams used in this rule. DataCollectionRuleStreamDeclarations

DataFlow

Name Description Value
destinations List of destinations for this data flow. string[]
outputStream The output stream of the transform. Only required if the transform changes data to a different stream. string
streams List of streams for this data flow. String array containing any of:
'Microsoft-Event'
'Microsoft-InsightsMetrics'
'Microsoft-Perf'
'Microsoft-Syslog'
'Microsoft-WindowsEvent'
transformKql The KQL query to transform stream data. string

DataCollectionRuleDataSources

Name Description Value
extensions The list of Azure VM extension data source configurations. ExtensionDataSource[]
iisLogs The list of IIS logs source configurations. IisLogsDataSource[]
logFiles The list of Log files source configurations. LogFilesDataSource[]
performanceCounters The list of performance counter data source configurations. PerfCounterDataSource[]
syslog The list of Syslog data source configurations. SyslogDataSource[]
windowsEventLogs The list of Windows Event Log data source configurations. WindowsEventLogDataSource[]

ExtensionDataSource

Name Description Value
extensionName The name of the VM extension. string (required)
extensionSettings The extension settings. The format is specific for particular extension. For Bicep, you can use the any() function.
inputDataSources The list of data sources this extension needs data from. string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-Event'
'Microsoft-InsightsMetrics'
'Microsoft-Perf'
'Microsoft-Syslog'
'Microsoft-WindowsEvent'

IisLogsDataSource

Name Description Value
logDirectories Absolute paths file location string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams IIS streams string[] (required)

LogFilesDataSource

Name Description Value
filePatterns File Patterns where the log files are located string[] (required)
format The data format of the log files 'text' (required)
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
settings The log files specific settings. LogFilesDataSourceSettings
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data source
string[] (required)

LogFilesDataSourceSettings

Name Description Value
text Text settings LogFileSettingsText

LogFileSettingsText

Name Description Value
recordStartTimestampFormat One of the supported timestamp formats 'ISO 8601'
'M/D/YYYY HH:MM:SS AM/PM'
'MMM d hh:mm:ss'
'Mon DD, YYYY HH:MM:SS'
'YYYY-MM-DD HH:MM:SS'
'dd/MMM/yyyy:HH:mm:ss zzz'
'ddMMyy HH:mm:ss'
'yyMMdd HH:mm:ss'
'yyyy-MM-ddTHH:mm:ssK' (required)

PerfCounterDataSource

Name Description Value
counterSpecifiers A list of specifier names of the performance counters you want to collect.
Use a wildcard (*) to collect a counter for all instances.
To get a list of performance counters on Windows, run the command 'typeperf'.
string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
samplingFrequencyInSeconds The number of seconds between consecutive counter measurements (samples). int
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-InsightsMetrics'
'Microsoft-Perf'

SyslogDataSource

Name Description Value
facilityNames The list of facility names. String array containing any of:
'*'
'auth'
'authpriv'
'cron'
'daemon'
'kern'
'local0'
'local1'
'local2'
'local3'
'local4'
'local5'
'local6'
'local7'
'lpr'
'mail'
'mark'
'news'
'syslog'
'user'
'uucp'
logLevels The log levels to collect. String array containing any of:
'*'
'Alert'
'Critical'
'Debug'
'Emergency'
'Error'
'Info'
'Notice'
'Warning'
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-Syslog'

WindowsEventLogDataSource

Name Description Value
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-Event'
'Microsoft-WindowsEvent'
xPathQueries A list of Windows Event Log queries in XPATH format. string[]

DataCollectionRuleDestinations

Name Description Value
azureMonitorMetrics Azure Monitor Metrics destination. DestinationsSpecAzureMonitorMetrics
logAnalytics List of Log Analytics destinations. LogAnalyticsDestination[]

DestinationsSpecAzureMonitorMetrics

Name Description Value
name A friendly name for the destination.
This name should be unique across all destinations (regardless of type) within the data collection rule.
string

LogAnalyticsDestination

Name Description Value
name A friendly name for the destination.
This name should be unique across all destinations (regardless of type) within the data collection rule.
string
workspaceResourceId The resource ID of the Log Analytics workspace. string

DataCollectionRuleStreamDeclarations

Name Description Value
{customized property} StreamDeclaration

StreamDeclaration

Name Description Value
columns List of columns used by data in this stream. ColumnDefinition[]

ColumnDefinition

Name Description Value
name The name of the column. string
type The type of the column data. 'boolean'
'datetime'
'dynamic'
'int'
'long'
'real'
'string'

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Deploy Darktrace Autoscaling vSensors

Deploy to Azure
This template allows you to deploy an automatically autoscaling deployment of Darktrace vSensors
Data Collection Rule for Syslog

Deploy to Azure
This template creates a data collection rule defining the data source (Syslog) and the destination workspace.

ARM template resource definition

The dataCollectionRules resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/dataCollectionRules resource, add the following JSON to your template.

{
  "type": "Microsoft.Insights/dataCollectionRules",
  "apiVersion": "2021-09-01-preview",
  "name": "string",
  "location": "string",
  "tags": {
    "tagName1": "tagValue1",
    "tagName2": "tagValue2"
  },
  "kind": "string",
  "properties": {
    "dataCollectionEndpointId": "string",
    "dataFlows": [
      {
        "destinations": [ "string" ],
        "outputStream": "string",
        "streams": [ "string" ],
        "transformKql": "string"
      }
    ],
    "dataSources": {
      "extensions": [
        {
          "extensionName": "string",
          "extensionSettings": {},
          "inputDataSources": [ "string" ],
          "name": "string",
          "streams": [ "string" ]
        }
      ],
      "iisLogs": [
        {
          "logDirectories": [ "string" ],
          "name": "string",
          "streams": [ "string" ]
        }
      ],
      "logFiles": [
        {
          "filePatterns": [ "string" ],
          "format": "text",
          "name": "string",
          "settings": {
            "text": {
              "recordStartTimestampFormat": "string"
            }
          },
          "streams": [ "string" ]
        }
      ],
      "performanceCounters": [
        {
          "counterSpecifiers": [ "string" ],
          "name": "string",
          "samplingFrequencyInSeconds": "int",
          "streams": [ "string" ]
        }
      ],
      "syslog": [
        {
          "facilityNames": [ "string" ],
          "logLevels": [ "string" ],
          "name": "string",
          "streams": "Microsoft-Syslog"
        }
      ],
      "windowsEventLogs": [
        {
          "name": "string",
          "streams": [ "string" ],
          "xPathQueries": [ "string" ]
        }
      ]
    },
    "description": "string",
    "destinations": {
      "azureMonitorMetrics": {
        "name": "string"
      },
      "logAnalytics": [
        {
          "name": "string",
          "workspaceResourceId": "string"
        }
      ]
    },
    "streamDeclarations": {
      "{customized property}": {
        "columns": [
          {
            "name": "string",
            "type": "string"
          }
        ]
      }
    }
  }
}

Property values

dataCollectionRules

Name Description Value
type The resource type 'Microsoft.Insights/dataCollectionRules'
apiVersion The resource api version '2021-09-01-preview'
name The resource name string (required)
location The geo-location where the resource lives. string (required)
tags Resource tags. Dictionary of tag names and values. See Tags in templates
kind The kind of the resource. 'Linux'
'Windows'
properties Resource properties. DataCollectionRuleResourceProperties

DataCollectionRuleResourceProperties

Name Description Value
dataCollectionEndpointId The resource ID of the data collection endpoint that this rule can be used with. string
dataFlows The specification of data flows. DataFlow[]
dataSources The specification of data sources.
This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.
DataCollectionRuleDataSources
description Description of the data collection rule. string
destinations The specification of destinations. DataCollectionRuleDestinations
streamDeclarations Declaration of custom streams used in this rule. DataCollectionRuleStreamDeclarations

DataFlow

Name Description Value
destinations List of destinations for this data flow. string[]
outputStream The output stream of the transform. Only required if the transform changes data to a different stream. string
streams List of streams for this data flow. String array containing any of:
'Microsoft-Event'
'Microsoft-InsightsMetrics'
'Microsoft-Perf'
'Microsoft-Syslog'
'Microsoft-WindowsEvent'
transformKql The KQL query to transform stream data. string

DataCollectionRuleDataSources

Name Description Value
extensions The list of Azure VM extension data source configurations. ExtensionDataSource[]
iisLogs The list of IIS logs source configurations. IisLogsDataSource[]
logFiles The list of Log files source configurations. LogFilesDataSource[]
performanceCounters The list of performance counter data source configurations. PerfCounterDataSource[]
syslog The list of Syslog data source configurations. SyslogDataSource[]
windowsEventLogs The list of Windows Event Log data source configurations. WindowsEventLogDataSource[]

ExtensionDataSource

Name Description Value
extensionName The name of the VM extension. string (required)
extensionSettings The extension settings. The format is specific for particular extension.
inputDataSources The list of data sources this extension needs data from. string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-Event'
'Microsoft-InsightsMetrics'
'Microsoft-Perf'
'Microsoft-Syslog'
'Microsoft-WindowsEvent'

IisLogsDataSource

Name Description Value
logDirectories Absolute paths file location string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams IIS streams string[] (required)

LogFilesDataSource

Name Description Value
filePatterns File Patterns where the log files are located string[] (required)
format The data format of the log files 'text' (required)
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
settings The log files specific settings. LogFilesDataSourceSettings
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data source
string[] (required)

LogFilesDataSourceSettings

Name Description Value
text Text settings LogFileSettingsText

LogFileSettingsText

Name Description Value
recordStartTimestampFormat One of the supported timestamp formats 'ISO 8601'
'M/D/YYYY HH:MM:SS AM/PM'
'MMM d hh:mm:ss'
'Mon DD, YYYY HH:MM:SS'
'YYYY-MM-DD HH:MM:SS'
'dd/MMM/yyyy:HH:mm:ss zzz'
'ddMMyy HH:mm:ss'
'yyMMdd HH:mm:ss'
'yyyy-MM-ddTHH:mm:ssK' (required)

PerfCounterDataSource

Name Description Value
counterSpecifiers A list of specifier names of the performance counters you want to collect.
Use a wildcard (*) to collect a counter for all instances.
To get a list of performance counters on Windows, run the command 'typeperf'.
string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
samplingFrequencyInSeconds The number of seconds between consecutive counter measurements (samples). int
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-InsightsMetrics'
'Microsoft-Perf'

SyslogDataSource

Name Description Value
facilityNames The list of facility names. String array containing any of:
'*'
'auth'
'authpriv'
'cron'
'daemon'
'kern'
'local0'
'local1'
'local2'
'local3'
'local4'
'local5'
'local6'
'local7'
'lpr'
'mail'
'mark'
'news'
'syslog'
'user'
'uucp'
logLevels The log levels to collect. String array containing any of:
'*'
'Alert'
'Critical'
'Debug'
'Emergency'
'Error'
'Info'
'Notice'
'Warning'
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-Syslog'

WindowsEventLogDataSource

Name Description Value
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
'Microsoft-Event'
'Microsoft-WindowsEvent'
xPathQueries A list of Windows Event Log queries in XPATH format. string[]

DataCollectionRuleDestinations

Name Description Value
azureMonitorMetrics Azure Monitor Metrics destination. DestinationsSpecAzureMonitorMetrics
logAnalytics List of Log Analytics destinations. LogAnalyticsDestination[]

DestinationsSpecAzureMonitorMetrics

Name Description Value
name A friendly name for the destination.
This name should be unique across all destinations (regardless of type) within the data collection rule.
string

LogAnalyticsDestination

Name Description Value
name A friendly name for the destination.
This name should be unique across all destinations (regardless of type) within the data collection rule.
string
workspaceResourceId The resource ID of the Log Analytics workspace. string

DataCollectionRuleStreamDeclarations

Name Description Value
{customized property} StreamDeclaration

StreamDeclaration

Name Description Value
columns List of columns used by data in this stream. ColumnDefinition[]

ColumnDefinition

Name Description Value
name The name of the column. string
type The type of the column data. 'boolean'
'datetime'
'dynamic'
'int'
'long'
'real'
'string'

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Deploy Darktrace Autoscaling vSensors

Deploy to Azure
This template allows you to deploy an automatically autoscaling deployment of Darktrace vSensors
Data Collection Rule for Syslog

Deploy to Azure
This template creates a data collection rule defining the data source (Syslog) and the destination workspace.

Terraform (AzAPI provider) resource definition

The dataCollectionRules resource type can be deployed with operations that target:

  • Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/dataCollectionRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Insights/dataCollectionRules@2021-09-01-preview"
  name = "string"
  location = "string"
  parent_id = "string"
  tags = {
    tagName1 = "tagValue1"
    tagName2 = "tagValue2"
  }
  body = jsonencode({
    properties = {
      dataCollectionEndpointId = "string"
      dataFlows = [
        {
          destinations = [
            "string"
          ]
          outputStream = "string"
          streams = [
            "string"
          ]
          transformKql = "string"
        }
      ]
      dataSources = {
        extensions = [
          {
            extensionName = "string"
            inputDataSources = [
              "string"
            ]
            name = "string"
            streams = [
              "string"
            ]
          }
        ]
        iisLogs = [
          {
            logDirectories = [
              "string"
            ]
            name = "string"
            streams = [
              "string"
            ]
          }
        ]
        logFiles = [
          {
            filePatterns = [
              "string"
            ]
            format = "text"
            name = "string"
            settings = {
              text = {
                recordStartTimestampFormat = "string"
              }
            }
            streams = [
              "string"
            ]
          }
        ]
        performanceCounters = [
          {
            counterSpecifiers = [
              "string"
            ]
            name = "string"
            samplingFrequencyInSeconds = int
            streams = [
              "string"
            ]
          }
        ]
        syslog = [
          {
            facilityNames = [
              "string"
            ]
            logLevels = [
              "string"
            ]
            name = "string"
            streams = "Microsoft-Syslog"
          }
        ]
        windowsEventLogs = [
          {
            name = "string"
            streams = [
              "string"
            ]
            xPathQueries = [
              "string"
            ]
          }
        ]
      }
      description = "string"
      destinations = {
        azureMonitorMetrics = {
          name = "string"
        }
        logAnalytics = [
          {
            name = "string"
            workspaceResourceId = "string"
          }
        ]
      }
      streamDeclarations = {
        {customized property} = {
          columns = [
            {
              name = "string"
              type = "string"
            }
          ]
        }
      }
    }
    kind = "string"
  })
}

Property values

dataCollectionRules

Name Description Value
type The resource type "Microsoft.Insights/dataCollectionRules@2021-09-01-preview"
name The resource name string (required)
location The geo-location where the resource lives. string (required)
parent_id To deploy to a resource group, use the ID of that resource group. string (required)
tags Resource tags. Dictionary of tag names and values.
kind The kind of the resource. "Linux"
"Windows"
properties Resource properties. DataCollectionRuleResourceProperties

DataCollectionRuleResourceProperties

Name Description Value
dataCollectionEndpointId The resource ID of the data collection endpoint that this rule can be used with. string
dataFlows The specification of data flows. DataFlow[]
dataSources The specification of data sources.
This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.
DataCollectionRuleDataSources
description Description of the data collection rule. string
destinations The specification of destinations. DataCollectionRuleDestinations
streamDeclarations Declaration of custom streams used in this rule. DataCollectionRuleStreamDeclarations

DataFlow

Name Description Value
destinations List of destinations for this data flow. string[]
outputStream The output stream of the transform. Only required if the transform changes data to a different stream. string
streams List of streams for this data flow. String array containing any of:
"Microsoft-Event"
"Microsoft-InsightsMetrics"
"Microsoft-Perf"
"Microsoft-Syslog"
"Microsoft-WindowsEvent"
transformKql The KQL query to transform stream data. string

DataCollectionRuleDataSources

Name Description Value
extensions The list of Azure VM extension data source configurations. ExtensionDataSource[]
iisLogs The list of IIS logs source configurations. IisLogsDataSource[]
logFiles The list of Log files source configurations. LogFilesDataSource[]
performanceCounters The list of performance counter data source configurations. PerfCounterDataSource[]
syslog The list of Syslog data source configurations. SyslogDataSource[]
windowsEventLogs The list of Windows Event Log data source configurations. WindowsEventLogDataSource[]

ExtensionDataSource

Name Description Value
extensionName The name of the VM extension. string (required)
extensionSettings The extension settings. The format is specific for particular extension.
inputDataSources The list of data sources this extension needs data from. string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
"Microsoft-Event"
"Microsoft-InsightsMetrics"
"Microsoft-Perf"
"Microsoft-Syslog"
"Microsoft-WindowsEvent"

IisLogsDataSource

Name Description Value
logDirectories Absolute paths file location string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams IIS streams string[] (required)

LogFilesDataSource

Name Description Value
filePatterns File Patterns where the log files are located string[] (required)
format The data format of the log files "text" (required)
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
settings The log files specific settings. LogFilesDataSourceSettings
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data source
string[] (required)

LogFilesDataSourceSettings

Name Description Value
text Text settings LogFileSettingsText

LogFileSettingsText

Name Description Value
recordStartTimestampFormat One of the supported timestamp formats "ISO 8601"
"M/D/YYYY HH:MM:SS AM/PM"
"MMM d hh:mm:ss"
"Mon DD, YYYY HH:MM:SS"
"YYYY-MM-DD HH:MM:SS"
"dd/MMM/yyyy:HH:mm:ss zzz"
"ddMMyy HH:mm:ss"
"yyMMdd HH:mm:ss"
"yyyy-MM-ddTHH:mm:ssK" (required)

PerfCounterDataSource

Name Description Value
counterSpecifiers A list of specifier names of the performance counters you want to collect.
Use a wildcard (*) to collect a counter for all instances.
To get a list of performance counters on Windows, run the command 'typeperf'.
string[]
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
samplingFrequencyInSeconds The number of seconds between consecutive counter measurements (samples). int
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
"Microsoft-InsightsMetrics"
"Microsoft-Perf"

SyslogDataSource

Name Description Value
facilityNames The list of facility names. String array containing any of:
"*"
"auth"
"authpriv"
"cron"
"daemon"
"kern"
"local0"
"local1"
"local2"
"local3"
"local4"
"local5"
"local6"
"local7"
"lpr"
"mail"
"mark"
"news"
"syslog"
"user"
"uucp"
logLevels The log levels to collect. String array containing any of:
"*"
"Alert"
"Critical"
"Debug"
"Emergency"
"Error"
"Info"
"Notice"
"Warning"
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
"Microsoft-Syslog"

WindowsEventLogDataSource

Name Description Value
name A friendly name for the data source.
This name should be unique across all data sources (regardless of type) within the data collection rule.
string
streams List of streams that this data source will be sent to.
A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
String array containing any of:
"Microsoft-Event"
"Microsoft-WindowsEvent"
xPathQueries A list of Windows Event Log queries in XPATH format. string[]

DataCollectionRuleDestinations

Name Description Value
azureMonitorMetrics Azure Monitor Metrics destination. DestinationsSpecAzureMonitorMetrics
logAnalytics List of Log Analytics destinations. LogAnalyticsDestination[]

DestinationsSpecAzureMonitorMetrics

Name Description Value
name A friendly name for the destination.
This name should be unique across all destinations (regardless of type) within the data collection rule.
string

LogAnalyticsDestination

Name Description Value
name A friendly name for the destination.
This name should be unique across all destinations (regardless of type) within the data collection rule.
string
workspaceResourceId The resource ID of the Log Analytics workspace. string

DataCollectionRuleStreamDeclarations

Name Description Value
{customized property} StreamDeclaration

StreamDeclaration

Name Description Value
columns List of columns used by data in this stream. ColumnDefinition[]

ColumnDefinition

Name Description Value
name The name of the column. string
type The type of the column data. "boolean"
"datetime"
"dynamic"
"int"
"long"
"real"
"string"