Tables - Update

Update a Log Analytics workspace table.

PATCH https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2021-12-01-preview

URI Parameters

Name In Required Type Description
resourceGroupName
path True
  • string

The name of the resource group. The name is case insensitive.

subscriptionId
path True
  • string

The ID of the target subscription.

tableName
path True
  • string

The name of the table.

workspaceName
path True
  • string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True
  • string

The API version to use for this operation.

Request Body

Name Type Description
properties.plan

Instruct the system how to handle and charge the logs ingested to this table.

properties.restoredLogs

Parameters of the restore operation that initiated this table.

properties.resultStatistics

Search job execution statistics.

properties.retentionInDays
  • integer

The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention.

properties.schema

Table schema.

properties.searchResults

Parameters of the search job that initiated this table.

properties.totalRetentionInDays
  • integer

The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention.

Responses

Name Type Description
200 OK

OK response definition.

202 Accepted

Accepted response definition (Long running operation).

Other Status Codes

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

TablesUpsert

Sample Request

PATCH https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685/tables/AzureNetworkFlow?api-version=2021-12-01-preview

{
  "properties": {
    "schema": {
      "name": "AzureNetworkFlow",
      "columns": [
        {
          "name": "MyNewColumn",
          "type": "guid"
        }
      ]
    },
    "retentionInDays": 45,
    "totalRetentionInDays": 70
  }
}

Sample Response

{
  "properties": {
    "schema": {
      "name": "AzureNetworkFlow",
      "tableSubType": "DataCollectionRuleBased",
      "tableType": "Microsoft",
      "columns": [
        {
          "isHidden": false,
          "name": "MyNewColumn",
          "type": "guid",
          "isDefaultDisplay": false
        }
      ],
      "standardColumns": [
        {
          "isHidden": true,
          "name": "TenantId",
          "type": "guid",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "SourceSystem",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "TimeGenerated",
          "type": "dateTime",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "AgentID",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "SourceIP",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "Protocol",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "SourcePort",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "DestinationPort",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "TcpFlags",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "Packets",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "Bytes",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "BytesOut",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "DurationInMs",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "RstCount",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "MaxSampleRtt",
          "type": "int",
          "isDefaultDisplay": false
        }
      ],
      "solutions": [
        "LogManagement"
      ]
    },
    "provisioningState": "Succeeded",
    "retentionInDays": 45,
    "totalRetentionInDays": 70,
    "archiveRetentionInDays": 25,
    "plan": "Analytics"
  },
  "id": "/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685/tables/AzureNetworkFlow",
  "name": "AzureNetworkFlow"
}

Definitions

Column

Table column.

ColumnDataTypeHintEnum

Column data type logical hint.

ColumnTypeEnum

Column data type.

createdByType

The type of identity that created the resource.

ErrorAdditionalInfo

The resource management error additional info.

ErrorDetail

The error detail.

ErrorResponse

Error response

ProvisioningStateEnum

Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.

RestoredLogs

Restore parameters.

ResultStatistics

Search job execution statistics.

Schema

Table's schema.

SearchResults

Parameters of the search job that initiated this table.

SourceEnum

Table's creator.

systemData

Metadata pertaining to creation and last modification of the resource.

Table

Workspace data table definition.

TablePlanEnum

Instruct the system how to handle and charge the logs ingested to this table.

TableSubTypeEnum

The subtype describes what APIs can be used to interact with the table, and what features are available against it.

TableTypeEnum

Table's creator.

Column

Table column.

Name Type Description
dataTypeHint

Column data type logical hint.

description
  • string

Column description.

displayName
  • string

Column display name.

isDefaultDisplay
  • boolean

Is displayed by default.

isHidden
  • boolean

Is column hidden.

name
  • string

Column name.

type

Column data type.

ColumnDataTypeHintEnum

Column data type logical hint.

Name Type Description
armPath
  • string

An Azure Resource Model (ARM) path: /subscriptions/{...}/resourceGroups/{...}/providers/Microsoft.{...}/{...}/{...}/{...}...

guid
  • string

A standard 128-bit GUID following the standard shape, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

ip
  • string

A standard V4/V6 ip address following the standard shape, x.x.x.x/y:y:y:y:y:y:y:y

uri
  • string

A string that matches the pattern of a URI, for example, scheme://username:password@host:1234/this/is/a/path?k1=v1&k2=v2#fragment

ColumnTypeEnum

Column data type.

Name Type Description
boolean
  • string
dateTime
  • string
dynamic
  • string
guid
  • string
int
  • string
long
  • string
real
  • string
string
  • string

createdByType

The type of identity that created the resource.

Name Type Description
Application
  • string
Key
  • string
ManagedIdentity
  • string
User
  • string

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info
  • object

The additional info.

type
  • string

The additional info type.

ErrorDetail

The error detail.

Name Type Description
additionalInfo

The error additional info.

code
  • string

The error code.

details

The error details.

message
  • string

The error message.

target
  • string

The error target.

ErrorResponse

Error response

Name Type Description
error

The error object.

ProvisioningStateEnum

Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.

Name Type Description
InProgress
  • string

Table schema is stable and without changes, table data is being updated.

Succeeded
  • string

Table state is stable and without changes, table is unlocked and open for new updates.

Updating
  • string

Table schema is still being built and updated, table is currently locked for any changes till the procedure is done.

RestoredLogs

Restore parameters.

Name Type Description
endRestoreTime
  • string

The timestamp to end the restore by (UTC).

sourceTable
  • string

The table to restore data from.

startRestoreTime
  • string

The timestamp to start the restore from (UTC).

ResultStatistics

Search job execution statistics.

Name Type Description
ingestedRecords
  • integer

The number of rows that were returned by the search job.

progress
  • number

Search job completion percentage.

Schema

Table's schema.

Name Type Description
categories
  • string[]

Table category.

columns

A list of table custom columns.

description
  • string

Table description.

displayName
  • string

Table display name.

labels
  • string[]

Table labels.

name
  • string

Table name.

restoredLogs

Parameters of the restore operation that initiated this table.

searchResults

Parameters of the search job that initiated this table.

solutions
  • string[]

List of solutions the table is affiliated with

source

Table's creator.

standardColumns

A list of table standard columns.

tableSubType

The subtype describes what APIs can be used to interact with the table, and what features are available against it.

tableType

Table's creator.

SearchResults

Parameters of the search job that initiated this table.

Name Type Description
description
  • string

Search job Description.

endSearchTime
  • string

The timestamp to end the search by (UTC)

limit
  • integer

Limit the search job to return up to specified number of rows.

query
  • string

Search job query.

sourceTable
  • string

The table used in the search job.

startSearchTime
  • string

The timestamp to start the search from (UTC)

SourceEnum

Table's creator.

Name Type Description
customer
  • string

Tables created by the owner of the Workspace, and only found in this Workspace.

microsoft
  • string

Tables provisioned by the system, as collected via Diagnostic Settings, the Agents, or any other standard data collection means.

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt
  • string

The timestamp of resource creation (UTC).

createdBy
  • string

The identity that created the resource.

createdByType

The type of identity that created the resource.

lastModifiedAt
  • string

The timestamp of resource last modification (UTC)

lastModifiedBy
  • string

The identity that last modified the resource.

lastModifiedByType

The type of identity that last modified the resource.

Table

Workspace data table definition.

Name Type Description
id
  • string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

name
  • string

The name of the resource

properties.archiveRetentionInDays
  • integer

The table data archive retention in days. Calculated as (totalRetentionInDays-retentionInDays)

properties.lastPlanModifiedDate
  • string

The timestamp that table plan was last modified (UTC).

properties.plan

Instruct the system how to handle and charge the logs ingested to this table.

properties.provisioningState

Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.

properties.restoredLogs

Parameters of the restore operation that initiated this table.

properties.resultStatistics

Search job execution statistics.

properties.retentionInDays
  • integer

The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention.

properties.schema

Table schema.

properties.searchResults

Parameters of the search job that initiated this table.

properties.totalRetentionInDays
  • integer

The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention.

systemData

Metadata pertaining to creation and last modification of the resource.

type
  • string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

TablePlanEnum

Instruct the system how to handle and charge the logs ingested to this table.

Name Type Description
Analytics
  • string

Logs that allow monitoring and analytics.

Basic
  • string

Logs that are adjusted to support high volume low value verbose logs.

TableSubTypeEnum

The subtype describes what APIs can be used to interact with the table, and what features are available against it.

Name Type Description
Any
  • string

The default subtype with which built-in tables are created.

Classic
  • string

Indicates a table created through the Data Collector API or with the custom logs feature of the MMA agent, or any table against which Custom Fields were created.

DataCollectionRuleBased
  • string

A table eligible to have data sent into it via any of the means supported by Data Collection Rules: the Data Collection Endpoint API, ingestion-time transformations, or any other mechanism provided by Data Collection Rules

TableTypeEnum

Table's creator.

Name Type Description
CustomLog
  • string

Custom log table.

Microsoft
  • string

Standard data collected by Azure Monitor.

RestoredLogs
  • string

Restored data.

SearchResults
  • string

Data collected by a search job.