Configure Basic Logs in Azure Monitor (Preview)

Setting a table's log data plan to Basic Logs lets you save on the cost of storing high-volume verbose logs you use for debugging, troubleshooting and auditing, but not for analytics and alerts. This article describes how to configure Basic Logs for a particular table in your Log Analytics workspace.

Important

You can switch a table's plan once a week. The Basic Logs feature is not available for workspaces in legacy pricing tiers.

Which tables support Basic Logs?

By default, all tables in your Log Analytics are Analytics tables, and available for query and alerts. You can currently configure the following tables for Basic Logs:

• All tables created with the Data Collection Rule (DCR)-based logs ingestion API.
• ContainerLogV2, which Container Insights uses and which include verbose text-based log records.
• AppTraces, which contains freeform log records for application traces in Application Insights.

Note

Tables created with the Data Collector API do not support Basic Logs.

Set table configuration

Portal

To configure a table for Basic Logs or Analytics Logs in the Azure portal:

1. From the Log Analytics workspaces menu, select Tables (preview).

   The Tables (preview) screen lists all of the tables in the workspace.

2. Select the context menu for the table you want to configure and select Manage table.

   

3. From the Table plan dropdown on the table configuration screen, select Basic or Analytics.

   The Table plan dropdown is enabled only for tables that support Basic Logs.

   

4. Select Save.

API

To configure a table for Basic Logs or Analytics Logs, call the Tables - Update API:

PATCH https://management.azure.com/subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/tables/<tableName>?api-version=2021-12-01-preview

Important

Use the Bearer token for authentication. Read more about using Bearer tokens.

Request body

Name	Type	Description
properties.plan	string	The table plan. Possible values are Analytics and Basic.

Example

This example configures the ContainerLogV2 table for Basic Logs.

Container Insights uses ContainerLog by default, to switch to using ContainerLogV2, please follow these instructions before attempting to convert the table to Basic Logs.

Sample request

PATCH https://management.azure.com/subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace/tables/ContainerLogV2?api-version=2021-12-01-preview

Use this request body to change to Basic Logs:

{
    "properties": {
        "plan": "Basic"
    }
}

Use this request body to change to Analytics Logs:

{
    "properties": {
        "plan": "Analytics"
    }
}

Sample response

This is the response for a table changed to Basic Logs.

Status code: 200

{
    "properties": {
        "retentionInDays": 8,
        "totalRetentionInDays": 30,
        "archiveRetentionInDays": 22,
        "plan": "Basic",
        "lastPlanModifiedDate": "2022-01-01T14:34:04.37",
        "schema": {...}        
    },
    "id": "subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace",
    "name": "ContainerLogV2"
}

CLI

To configure a table for Basic Logs or Analytics Logs, run the az monitor log-analytics workspace table update command and set the --plan parameter to Basic or Analytics.

For example:

• To set Basic Logs:

  az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLogV2  --plan Basic
  

• To set Analytics Logs:

  az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLogV2  --plan Analytics
  

Check table configuration

Portal

To check table configuration in the Azure portal, you can open the table configuration screen, as described in Set table configuration.

Alternatively:

1. From the Azure Monitor menu, select Logs and select your workspace for the scope. See Log Analytics tutorial for a walkthrough.

2. Open the Tables tab, which lists all tables in the workspace.

   Basic Logs tables have a unique icon:

   

   You can also hover over a table name for the table information view, which indicates whether the table is configured as Basic Logs:

   

API

To check the configuration of a table, call the Tables - Get API:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2021-12-01-preview

Response Body

Name	Type	Description
properties.plan	string	The table plan. Either "Analytics" or "Basic".
properties.retentionInDays	integer	The table's data retention in days. In Basic Logs, the value is 8 days, fixed. In Analytics Logs, between 7 and 730.
properties.totalRetentionInDays	integer	The table's data retention including Archive period
properties.archiveRetentionInDays	integer	The table's archive period (read-only, calculated).
properties.lastPlanModifiedDate	String	Last time when plan was set for this table. Null if no change was ever done from the default settings (read-only)

Sample Request

GET https://management.azure.com/subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace/tables/ContainerLogV2?api-version=2021-12-01-preview

Sample Response

Status code: 200

{
    "properties": {
        "retentionInDays": 8,
        "totalRetentionInDays": 8,
        "archiveRetentionInDays": 0,
        "plan": "Basic",
        "lastPlanModifiedDate": "2022-01-01T14:34:04.37",
        "schema": {...},
        "provisioningState": "Succeeded"        
    },
    "id": "subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace",
    "name": "ContainerLogV2"
}

CLI

To check the configuration of a table, run the az monitor log-analytics workspace table show command.

For example:

az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name Syslog --output table  

Retention and archiving of Basic Logs

Analytics tables retain data based on a retention and archive policy you set.

Basic Logs tables retain data for eight days. When you change an existing table's plan to Basic Logs, Azure archives data that is more than eight days old but still within the table's original retention period.

Next steps

• Learn more about the different log plans.
• Query data in Basic Logs.