Azure Monitor Logs table reference organized by resource type
Analysis Services
API Management services
App Services
- AppServiceAppLogs
- AppServiceAuditLogs
- AppServiceConsoleLogs
- AppServiceFileAuditLogs
- AppServiceHTTPLogs
- AppServiceIPSecAuditLogs
- AppServicePlatformLogs
- AzureActivity
- AzureMetrics
- FunctionAppLogs
Application Gateways
Application Insights
- AppAvailabilityResults
- AppBrowserTimings
- AppDependencies
- AppEvents
- AppMetrics
- AppPageViews
- AppPerformanceCounters
- AppRequests
- AppSystemEvents
- AppTraces
- AzureActivity
Automation account
Azure Active Directory Logs
Azure activity Log V2
Azure AD Domain Services
- AADDomainServicesAccountLogon
- AADDomainServicesAccountManagement
- AADDomainServicesDirectoryServiceAccess
- AADDomainServicesLogonLogoff
- AADDomainServicesPolicyChange
- AADDomainServicesPrivilegeUse
- AzureActivity
- AzureMetrics
Azure API for FHIR
Azure Arc enabled Kubernetes
- AzureActivity
- AzureDiagnostics
- AzureMetrics
- ContainerImageInventory
- ContainerInventory
- ContainerLog
- ContainerNodeInventory
- ContainerServiceLog
- Heartbeat
- InsightsMetrics
- KubeEvents
- KubeHealth
- KubeMonAgentEvents
- KubeNodeInventory
- KubePodInventory
- KubePVInventory
- KubeServices
- Perf
Azure Autonomous Development Platform Account
Azure Blockchain Service
Azure Cache for Redis
Azure Cosmos DB
- AzureActivity
- AzureDiagnostics
- AzureMetrics
- CDBCassandraRequests
- CDBControlPlaneRequests
- CDBDataPlaneRequests
- CDBGremlinRequests
- CDBMongoRequests
- CDBPartitionKeyRUConsumption
- CDBPartitionKeyStatistics
- CDBQueryRuntimeStatistics
Azure Data Explorer Clusters
- ADXCommand
- ADXIngestionBatching
- ADXJournal
- ADXQuery
- ADXTableDetails
- ADXTableUsageStatistics
- AzureActivity
- AzureMetrics
- FailedIngestion
- SucceededIngestion
Azure Database for MariaDB Servers
Azure Database for MySQL Servers
Azure Database for PostgreSQL Flexible Servers
Azure Database for PostgreSQL Servers
Azure Database for PostgreSQL Servers V2
Azure Databricks Services
- AzureActivity
- AzureMetrics
- DatabricksAccounts
- DatabricksClusters
- DatabricksDBFS
- DatabricksFeatureStore
- DatabricksGenie
- DatabricksGlobalInitScripts
- DatabricksIAMRole
- DatabricksInstancePools
- DatabricksInstancePools
- DatabricksJobs
- DatabricksMLflowAcledArtifact
- DatabricksMLflowExperiment
- DatabricksNotebook
- DatabricksRemoteHistoryService
- DatabricksSecrets
- DatabricksSQLPermissions
- DatabricksSSH
- DatabricksWorkspace
Azure Digital Twins
Azure Managed Instance for Apache Cassandra
Azure Monitor autoscale settings
Azure Resource Group
Azure Sentinel
Azure Sentinel Amazon
Azure Sentinel Anomaly Table
Azure Sentinel CEF Table
Azure Sentinel MCAS
Azure Sentinel MDA
Azure Sentinel MDE
Azure Sentinel MDI
Azure Sentinel MDO
Azure Sentinel Office 365
Azure Sentinel Watchlist
Azure Spring Cloud
- AppPlatformBuildLogs
- AppPlatformIngressLogs
- AppPlatformLogsforSpring
- AppPlatformSystemLogs
- AzureActivity
- AzureMetrics
Azure Stack HCI
- ADAssessmentRecommendation
- ADReplicationResult
- AzureActivity
- AzureMetrics
- CommonSecurityLog
- ComputerGroup
- ConfigurationChange
- ConfigurationData
- ContainerLog
- DnsEvents
- DnsInventory
- Event
- HealthStateChangeEvent
- Heartbeat
- InsightsMetrics
- Perf
- ProtectionStatus
- SecurityBaseline
- SecurityBaselineSummary
- SecurityEvent
- SQLAssessmentRecommendation
- Syslog
- Update
- UpdateRunProgress
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WindowsFirewall
- WireData
Azure Subscription
Azure Traffic Collector
Bastions
Batch Accounts
Bot Services
CDN Profiles
Cognitive Services
Communication Services
- ACSAuthIncomingOperations
- ACSBillingUsage
- ACSCallDiagnostics
- ACSCallSummary
- ACSChatIncomingOperations
- ACSNetworkTraversalIncomingOperations
- ACSSMSIncomingOperations
- AzureActivity
- AzureMetrics
Container Registries
Data factories
- ADFActivityRun
- ADFPipelineRun
- ADFSSISIntegrationRuntimeLogs
- ADFSSISPackageEventMessageContext
- ADFSSISPackageEventMessages
- ADFSSISPackageExecutableStatistics
- ADFSSISPackageExecutionComponentPhases
- ADFSSISPackageExecutionDataStatistics
- ADFTriggerRun
- AzureActivity
- AzureDiagnostics
- AzureMetrics
Data Lake Analytics
Data Lake Storage Gen1
Data Share
DataSecurityManagement
Default schema for a resource
Desktop Virtualization Application Groups
Desktop Virtualization Host Pools
- AzureActivity
- AzureMetrics
- WVDAgentHealthStatus
- WVDCheckpoints
- WVDConnections
- WVDErrors
- WVDHostRegistrations
- WVDManagement
Desktop Virtualization workspaces
Device Provisioning Services
Dynamics 365 Customer Insights
Event Grid Domains
Event Grid Topics
Event Hubs
Experiment Workspace
ExpressRoute Circuits
Firewalls
Front Doors
HDInsight Clusters
- AzureActivity
- HDInsightAmbariClusterAlerts
- HDInsightAmbariSystemMetrics
- HDInsightGatewayAuditLogs
- HDInsightHadoopAndYarnLogs
- HDInsightHadoopAndYarnMetrics
- HDInsightHBaseLogs
- HDInsightHBaseMetrics
- HDInsightHiveAndLLAPLogs
- HDInsightHiveAndLLAPMetrics
- HDInsightHiveQueryAppStats
- HDInsightHiveTezAppStats
- HDInsightJupyterNotebookEvents
- HDInsightKafkaLogs
- HDInsightKafkaMetrics
- HDInsightOozieLogs
- HDInsightRangerAuditLogs
- HDInsightSecurityLogs
- HDInsightSparkApplicationEvents
- HDInsightSparkBlockManagerEvents
- HDInsightSparkEnvironmentEvents
- HDInsightSparkExecutorEvents
- HDInsightSparkExtraEvents
- HDInsightSparkJobEvents
- HDInsightSparkLogs
- HDInsightSparkSQLExecutionEvents
- HDInsightSparkStageEvents
- HDInsightSparkStageTaskAccumulables
- HDInsightSparkTaskEvents
- HDInsightStormLogs
- HDInsightStormMetrics
- HDInsightStormTopologyMetrics
Intune Specialist Reports.
IoT Hub
Key Vaults
Kubernetes Services
- AzureActivity
- AzureDiagnostics
- AzureMetrics
- ContainerImageInventory
- ContainerInventory
- ContainerLog
- ContainerLogV2
- ContainerNodeInventory
- ContainerServiceLog
- Heartbeat
- InsightsMetrics
- KubeEvents
- KubeHealth
- KubeMonAgentEvents
- KubeNodeInventory
- KubePodInventory
- KubePVInventory
- KubeServices
- Perf
Load Balancers
Log Analytics workspaces
Logic Apps
Machine Learning
- AmlComputeClusterEvent
- AmlComputeClusterNodeEvent
- AmlComputeCpuGpuUtilization
- AmlComputeInstanceEvent
- AmlComputeJobEvent
- AmlDataLabelEvent
- AmlDataSetEvent
- AmlDataStoreEvent
- AmlDeploymentEvent
- AmlEnvironmentEvent
- AmlInferencingEvent
- AmlModelsEvent
- AmlOnlineEndpointConsoleLog
- AmlPipelineEvent
- AmlRunEvent
- AmlRunStatusChangedEvent
- AzureActivity
- AzureMetrics
- BaiClusterEvent
- BaiClusterNodeEvent
- BaiJobEvent
Media Services
Microsoft App Configuration
Microsoft Authorization Datasets
Microsoft Connected Cache
Microsoft Connected Vehicle Platform
Microsoft Defender for cloud
Microsoft Sentinel DNS activity ASim schema
Microsoft.AgFoodPlatform/farmBeats
- AgriFoodApplicationAuditLogs
- AgriFoodFarmManagementLogs
- AgriFoodFarmOperationLogs
- AgriFoodInsightLogs
- AgriFoodJobProcessedLogs
- AgriFoodModelInferenceLogs
- AgriFoodProviderAuthLogs
- AgriFoodSatelliteLogs
- AgriFoodWeatherLogs
Microsoft.Dynamics.FraudProtection/purchase
Microsoft.Purview/accounts
Network Interfaces
Network Security Groups
Network Watcher - Connection Monitor
- AzureActivity
- NWConnectionMonitorDNSResult
- NWConnectionMonitorPathResult
- NWConnectionMonitorTestResult
Power BI Datasets
Power BI Embedded
Project CI Workspace
Public IP Addresses
Recovery Services Vaults
- AddonAzureBackupAlerts
- AddonAzureBackupJobs
- AddonAzureBackupPolicy
- AddonAzureBackupProtectedInstance
- AddonAzureBackupStorage
- AzureActivity
- AzureDiagnostics
- CoreAzureBackup
Search Services
SecurityInsights
Service Bus
Service Fabric Clusters
SignalR
SQL Databases
SQL Managed Instances
SQL Servers
Storage Accounts
Stream Analytics jobs
Synapse Workspaces
- AzureActivity
- AzureMetrics
- SQLSecurityAuditEvents
- SynapseBigDataPoolApplicationsEnded
- SynapseBuiltinSqlPoolRequestsEnded
- SynapseDXCommand
- SynapseDXFailedIngestion
- SynapseDXIngestionBatching
- SynapseDXQuery
- SynapseDXSucceededIngestion
- SynapseDXTableDetails
- SynapseDXTableUsageStatistics
- SynapseGatewayApiRequests
- SynapseIntegrationActivityRuns
- SynapseIntegrationPipelineRuns
- SynapseIntegrationTriggerRuns
- SynapseRbacOperations
- SynapseScopePoolScopeJobsEnded
- SynapseScopePoolScopeJobsStateChange
- SynapseSqlPoolDmsWorkers
- SynapseSqlPoolExecRequests
- SynapseSqlPoolRequestSteps
- SynapseSqlPoolSqlRequests
- SynapseSqlPoolWaits
System Center Virtual Machine Manager
- ADAssessmentRecommendation
- ADReplicationResult
- AzureActivity
- AzureMetrics
- CommonSecurityLog
- ComputerGroup
- ConfigurationChange
- ConfigurationData
- ContainerLog
- DnsEvents
- DnsInventory
- Event
- HealthStateChangeEvent
- Heartbeat
- InsightsMetrics
- Perf
- ProtectionStatus
- SecurityBaseline
- SecurityBaselineSummary
- SecurityEvent
- SQLAssessmentRecommendation
- Syslog
- Update
- UpdateRunProgress
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WindowsFirewall
- WireData
Time Series Insights Environments
Traffic Manager Profiles
Virtual Machine Scale Sets
- AzureActivity
- AzureMetrics
- CommonSecurityLog
- ConfigurationChange
- ConfigurationData
- ContainerLog
- Event
- Heartbeat
- InsightsMetrics
- Perf
- ProtectionStatus
- SecurityBaseline
- SecurityEvent
- Syslog
- Update
- UpdateRunProgress
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WindowsFirewall
- WireData
Virtual machines
- ADAssessmentRecommendation
- ADReplicationResult
- AzureActivity
- AzureMetrics
- CommonSecurityLog
- ComputerGroup
- ConfigurationChange
- ConfigurationData
- ContainerLog
- DnsEvents
- DnsInventory
- Event
- HealthStateChangeEvent
- Heartbeat
- InsightsMetrics
- Perf
- ProtectionStatus
- SecurityBaseline
- SecurityBaselineSummary
- SecurityEvent
- SQLAssessmentRecommendation
- Syslog
- Update
- UpdateRunProgress
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WindowsFirewall
- WireData
Virtual Network Gateways
Virtual Networks
Virtual Private Network Gateways
VMware
- ADAssessmentRecommendation
- ADReplicationResult
- AzureActivity
- AzureMetrics
- CommonSecurityLog
- ComputerGroup
- ConfigurationChange
- ConfigurationData
- ContainerLog
- DnsEvents
- DnsInventory
- Event
- HealthStateChangeEvent
- Heartbeat
- InsightsMetrics
- Perf
- ProtectionStatus
- SecurityBaseline
- SecurityBaselineSummary
- SecurityEvent
- SQLAssessmentRecommendation
- Syslog
- Update
- UpdateRunProgress
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WindowsFirewall
- WireData