Share via

Flow Logs - List

Service:
Network Watcher
API Version:
2025-03-01

Lists all flow log resources for the specified Network Watcher.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/flowLogs?api-version=2025-03-01

URI Parameters

Name In Required Type Description
networkWatcherName
 path True

string

The name of the Network Watcher resource.
resourceGroupName
 path True

string

The name of the resource group containing Network Watcher.
subscriptionId
 path True

string

The subscription credentials which uniquely identify the Microsoft Azure subscription. The subscription ID forms part of the URI for every service call.
api-version
 query True

string

Client API version.

Responses

Name Type Description
200 OK

FlowLogListResult

Successful flow log enumeration request.
Other Status Codes

ErrorResponse

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

List connection monitors

Sample request

GET https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/networkWatchers/nw1/flowLogs?api-version=2025-03-01

Sample response

Status code:
200 
{
  "value": [
    {
      "name": "flowLog1",
      "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/networkWatchers/тц1/FlowLogs/flowLog1",
      "etag": "W/\"00000000-0000-0000-0000-000000000000\"",
      "properties": {
        "provisioningState": "Succeeded",
        "targetResourceId": "/subscriptions/subid/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/vm5-nsg",
        "targetResourceGuid": "00000000-0000-0000-0000-000000000000",
        "storageId": "/subscriptions/subid/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/wzstorage002",
        "enabledFilteringCriteria": "srcIP=158.255.7.8 || dstPort=56891",
        "recordTypes": "B,E",
        "enabled": true,
        "flowAnalyticsConfiguration": {
          "networkWatcherFlowAnalyticsConfiguration": {
            "enabled": false,
            "workspaceId": "-",
            "workspaceRegion": "-",
            "trafficAnalyticsInterval": 60
          }
        },
        "retentionPolicy": {
          "days": 0,
          "enabled": false
        },
        "format": {
          "type": "JSON",
          "version": 2
        }
      },
      "location": "centraluseuap",
      "type": "Microsoft.Network/networkWatchers/FlowLogs",
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id1": {
            "clientId": "c16d15e1-f60a-40e4-8a05-df3d3f655c14",
            "principalId": "e3858881-e40c-43bd-9cde-88da39c05023"
          }
        }
      }
    },
    {
      "name": "flowLog2",
      "id": "/subscriptions/96e68903-0a56-4819-9987-8d08ad6a1f99/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_centraluseuap/FlowLogs/flowLog2",
      "etag": "W/\"00000000-0000-0000-0000-000000000000\"",
      "properties": {
        "provisioningState": "Succeeded",
        "targetResourceId": "/subscriptions/subid/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/DSCP-test-vm1-nsg",
        "targetResourceGuid": "00000000-0000-0000-0000-000000000000",
        "storageId": "/subscriptions/subid/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/iraflowlogtest2diag",
        "enabledFilteringCriteria": "srcIP=158.255.7.8 || dstPort=56891",
        "recordTypes": "B,E",
        "enabled": true,
        "flowAnalyticsConfiguration": {},
        "retentionPolicy": {
          "days": 0,
          "enabled": false
        },
        "format": {
          "type": "JSON",
          "version": 2
        }
      },
      "type": "Microsoft.Network/networkWatchers/FlowLogs",
      "location": "centraluseuap",
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id1": {
            "clientId": "c16d15e1-f60a-40e4-8a05-df3d3f655c14",
            "principalId": "e3858881-e40c-43bd-9cde-88da39c05023"
          }
        }
      }
    }
  ]
}

Definitions

Name Description
ErrorDetails

Common error details representation.
ErrorResponse

The error object.
FlowLog

A flow log resource.
FlowLogFormatParameters

Parameters that define the flow log format.
FlowLogFormatType

The file type of flow log.
FlowLogListResult

List of flow logs.
ManagedServiceIdentity

Identity for the resource.
ProvisioningState

The current provisioning state.
ResourceIdentityType

The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.
RetentionPolicyParameters

Parameters that define the retention policy for flow log.
TrafficAnalyticsConfigurationProperties

Parameters that define the configuration of traffic analytics.
TrafficAnalyticsProperties

Parameters that define the configuration of traffic analytics.
UserAssignedIdentities

The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

ErrorDetails

Object

Common error details representation.

Name Type Description
code

string

Error code.
message

string

Error message.
target

string

Error target.

ErrorResponse

Object

The error object.

Name Type Description
error

ErrorDetails

Error
The error details object.

FlowLog

Object

A flow log resource.

Name Type Description
etag

string

A unique read-only string that changes whenever the resource is updated.
id

string

Resource ID.
identity

ManagedServiceIdentity

FlowLog resource Managed Identity
location

string

Resource location.
name

string

Resource name.
properties.enabled

boolean

Flag to enable/disable flow logging.
properties.enabledFilteringCriteria

string

Optional field to filter network traffic logs based on SrcIP, SrcPort, DstIP, DstPort, Protocol, Encryption, Direction and Action. If not specified, all network traffic will be logged.
properties.flowAnalyticsConfiguration

TrafficAnalyticsProperties

Parameters that define the configuration of traffic analytics.
properties.format

FlowLogFormatParameters

Parameters that define the flow log format.
properties.provisioningState

ProvisioningState

The provisioning state of the flow log.
properties.recordTypes

string

Optional field to filter network traffic logs based on flow states. Value of this field could be any comma separated combination string of letters B,C,E or D. B represents Begin, when a flow is created. C represents Continue for an ongoing flow generated at every five-minute interval. E represents End, when a flow is terminated. D represents Deny, when a flow is denied. If not specified, all network traffic will be logged.
properties.retentionPolicy

RetentionPolicyParameters

Parameters that define the retention policy for flow log.
properties.storageId

string

ID of the storage account which is used to store the flow log.
properties.targetResourceGuid

string

Guid of network security group to which flow log will be applied.
properties.targetResourceId

string

ID of network security group to which flow log will be applied.
tags

object

Resource tags.
type

string

Resource type.

FlowLogFormatParameters

Object

Parameters that define the flow log format.

Name Type Default value Description
type

FlowLogFormatType

The file type of flow log.
version

integer (int32)

0

The version (revision) of the flow log.

FlowLogFormatType

Enumeration

The file type of flow log.

Value Description
JSON

FlowLogListResult

Object

List of flow logs.

Name Type Description
nextLink

string

The URL to get the next set of results.
value

FlowLog[]

Information about flow log resource.

ManagedServiceIdentity

Object

Identity for the resource.

Name Type Description
principalId

string

The principal id of the system assigned identity. This property will only be provided for a system assigned identity.
tenantId

string

The tenant id of the system assigned identity. This property will only be provided for a system assigned identity.
type

ResourceIdentityType

The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.
userAssignedIdentities

UserAssignedIdentities

The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

ProvisioningState

Enumeration

The current provisioning state.

Value Description
Succeeded
Updating
Deleting
Failed

ResourceIdentityType

Enumeration

The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.

Value Description
SystemAssigned
UserAssigned
SystemAssigned, UserAssigned
None

RetentionPolicyParameters

Object

Parameters that define the retention policy for flow log.

Name Type Default value Description
days

integer (int32)

0

Number of days to retain flow log records.
enabled

boolean

False

Flag to enable/disable retention.

TrafficAnalyticsConfigurationProperties

Object

Parameters that define the configuration of traffic analytics.

Name Type Description
enabled

boolean

Flag to enable/disable traffic analytics.
trafficAnalyticsInterval

integer (int32)

The interval in minutes which would decide how frequently TA service should do flow analytics.
workspaceId

string

The resource guid of the attached workspace.
workspaceRegion

string

The location of the attached workspace.
workspaceResourceId

string

Resource Id of the attached workspace.

TrafficAnalyticsProperties

Object

Parameters that define the configuration of traffic analytics.

Name Type Description
networkWatcherFlowAnalyticsConfiguration

TrafficAnalyticsConfigurationProperties

Parameters that define the configuration of traffic analytics.

UserAssignedIdentities

Object

The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

Name Type Description