Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article helps you learn how to set up a daily cap limit for a Log Analytics workspace.
Strategies for safeguarding against unexpected data ingestion surges
The daily cap on a Log Analytics workspace enables you to avoid unexpected increases in charges for data ingestion by stopping the collection of billable data for the rest of the day whenever a specified threshold is reached. Daily caps are typically used by organizations that are particularly cost-conscious. They shouldn't be used as a method to reduce costs but, instead, as a preventative measure to make sure that you don't exceed a particular budget.
When data collection stops, you effectively have no monitoring of features or resources that rely on that workspace. Instead of relying on the daily cap alone, you can create an alert rule to notify yourself when data collection reaches a specified level before the daily cap is reached. Notification enables you to address any increases before data collection shuts down, or even to temporarily disable collection for less critical resources.
Note
You should use care when you set a daily cap. This is because when data collection stops, you lose the ability to observe and receive alerts about when the health conditions of your resources will be affected. A daily cap can also affect other Azure services and solutions whose functionality may depend on up-to-date data being available in the workspace. Your goal shouldn't be to regularly hit the daily limit but, instead, to avoid unplanned charges that might be caused by an unexpected increase in the volume of data that's collected.
Configure daily cap
Sign in to the Azure portal.
Enter log analytics in the search bar.
Under Services, select Log Analytics.
Select your Log Analytics Workspace.
In the Settings section, select Usage and estimated costs.
On the Usage and estimated costs page, select Daily Cap at the top of the page.
Configure the Daily Cap settings. Notice that security data types aren't affected by the daily cap.
- Select ON to enable the daily cap.
- Set the data volume limit (in GB per day).
When the daily cap is reached for a Log Analytics workspace, a banner is displayed in the Azure portal, and an event is written to the Operations table in the workspace. You should create an alert rule to proactively notify yourself when this occurs.
The daily cap can't stop data collection at precisely the specified cap level and some excess data is expected. The data collection beyond the daily cap can be particularly large if the workspace is receiving high rates of data. If data is collected above the cap, it's still billed.
Next steps
Contact us for help
If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.