# Log Analytics workspace

Sends each record to a Log Analytics table, through a data collection rule.

## Example

Sends to the stream `Custom-Events_CL` of a data collection rule, signed in as the host's managed identity.

```
{
  "id": "events-out",
  "type": "logAnalytics",
  "endpoint": "https://acme-logs-a1b2.eastus-1.ingest.monitor.azure.com",
  "ruleId": "dcr-0123456789abcdef0123456789abcdef",
  "stream": "Custom-Events_CL"
}
```

## Before you start

-   Create the table and a data collection rule with a stream that sends to it. See Microsoft's [Logs Ingestion API tutorial](https://learn.microsoft.com/azure/azure-monitor/logs/tutorial-logs-ingestion-portal).
-   Choose how the destination signs in, with exactly one of:
    
    -   a service principal: set `tenantId`, `clientId` and `clientSecret`, with the secret in a [credential](/docs/secrets).
    -   a user-assigned managed identity: set `managedIdentityClientId` to its client id. Set it when the host has more than one managed identity.
    -   none: the destination signs in as the host's [managed identity](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview), or as an AKS pod's [workload identity](https://learn.microsoft.com/azure/aks/workload-identity-overview). The managed identities of App Service, Container Apps and Functions are not supported.
    
    See Microsoft's [Logs Ingestion API docs](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview) for the role it needs.
-   Allow workers to reach the endpoint on port 443.

## Settings

It also takes the settings [every destination](/docs/destinations#settings) takes.

`endpoint`  string required

The data collection rule's logs ingestion endpoint, or the data collection endpoint it is linked to.

Examples:

- `https://acme-logs-a1b2.eastus-1.ingest.monitor.azure.com`
- `https://acme-dce-x9y8.eastus-1.ingest.monitor.azure.us`

`ruleId`  string required

The data collection rule's immutable id.

Example:

- `dcr-00000000000000000000000000000000`

`stream`  string required

The rule's input stream the records are sent to.

Examples:

- `Custom-Events_CL`
- `Custom-Firewall`

`tenantId`  string default none

A service principal's tenant. Set `tenantId`, `clientId` and `clientSecret` together, or none of them.

Example:

- `00000000-0000-0000-0000-000000000000`

`clientId`  string default none

A service principal's client id.

Example:

- `11111111-1111-1111-1111-111111111111`

`clientSecret`  credential default none

The [credential](/docs/secrets) holding a service principal's client secret.

Examples:

- `AZURE_CLIENT_SECRET`
- `{"secret": "azure-client-secret","version": 1}`

`managedIdentityClientId`  string default the host's managed or workload identity

The client id of the user-assigned managed identity to sign in as. Set it when the worker's host has more than one managed identity. Left out, it signs in as the host's managed identity, or an AKS pod's workload identity.

Example:

- `22222222-2222-2222-2222-222222222222`

### Advanced

`authEndpoint`  string default its cloud's own

Where a client secret is exchanged for a token. Only with `clientSecret`.

Examples:

- `https://login.microsoftonline.us`
- `https://login.chinacloudapi.cn`

`identity`  identity default none

The [connection identity](/docs/secrets#identities) it connects under, for a private CA or a client certificate. Only on an `https://` URL.

Examples:

- `intake-client`
- `intake-mtls`

`inFlight`  integer default `4`

How many requests it sends at once to start with. 1 to 64.

Examples:

- `8`
- `1`
- `16`

`maxRequestBytes`  size default `1 MiB`

The most one request carries, before compression. A record larger than this still goes as a single record. 4 KiB to 1 MiB.

Examples:

- `512 KiB`
- `256 KiB`

`bufferBytes`  size default 64 MiB, or one request if that is larger

How much undelivered output it may hold. 4 MiB to 1 GiB, and at least one request.

Examples:

- `256 MiB`
- `64 MiB`
- `1 GiB`

`stallAfterSecs`  integer default `30`

Seconds one batch may take to deliver, every retry included, before the destination reports it stalled. 1 to 120.

Examples:

- `60`
- `120`

## How it works

The destination sends each batch as one gzipped JSON array to the rule's stream, signed in through Entra ID. It reads no `__destination` field. It handles each answer as the [HTTP destination](/docs/destinations/http#answers) does.

## Verify

Send a record you can recognize through the source, then query its table in the workspace.

## Troubleshooting

**The destination stalls, saying its credentials were refused**

Check that the identity it signs in as has the role the rule needs.

**The destination stalls on a 404**

Check the rule id, the stream, and that the endpoint is the rule's.

## See also

-   [Destinations](/docs/destinations)
-   [HTTP destination](/docs/destinations/http)
-   [Handle refused records](/docs/delivery#refused)