tables

Creates, updates, deletes, gets or lists a tables resource.

Overview

Name	tables
Type	Resource
Id	azure.log_analytics.tables

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
archiveRetentionInDays	integer	The tables long-term retention in days. Calculated as (totalRetentionInDays-retentionInDays).
lastPlanModifiedDate	string	The timestamp that table plan was last modified (UTC).
plan	string	Instruct the system how to handle and charge the logs ingested to this table. Known values are: "Basic", "Analytics", and "Auxiliary". (Basic, Analytics, Auxiliary)
provisioningState	string	Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded. Known values are: "Updating", "InProgress", "Succeeded", and "Deleting". (Updating, InProgress, Succeeded, Deleting)
restoredLogs	object	Parameters of the restore operation that initiated this table.
resultStatistics	object	Search job execution statistics.
retentionInDays	integer	In Analytics table: the tables analytics retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. In Basic and Auxiliary table: read only property.
retentionInDaysAsDefault	boolean	True - Value originates from workspace retention in days, False - Customer specific.
schema	object	Table schema.
searchResults	object	Parameters of the search job that initiated this table.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
totalRetentionInDays	integer	The table total retention in days, between 4 and 4383. Setting this property to -1 will default to retentionInDays.
totalRetentionInDaysAsDefault	boolean	True - Value originates from retention in days, False - Customer specific.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_by_workspace

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
archiveRetentionInDays	integer	The tables long-term retention in days. Calculated as (totalRetentionInDays-retentionInDays).
lastPlanModifiedDate	string	The timestamp that table plan was last modified (UTC).
plan	string	Instruct the system how to handle and charge the logs ingested to this table. Known values are: "Basic", "Analytics", and "Auxiliary". (Basic, Analytics, Auxiliary)
provisioningState	string	Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded. Known values are: "Updating", "InProgress", "Succeeded", and "Deleting". (Updating, InProgress, Succeeded, Deleting)
restoredLogs	object	Parameters of the restore operation that initiated this table.
resultStatistics	object	Search job execution statistics.
retentionInDays	integer	In Analytics table: the tables analytics retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. In Basic and Auxiliary table: read only property.
retentionInDaysAsDefault	boolean	True - Value originates from workspace retention in days, False - Customer specific.
schema	object	Table schema.
searchResults	object	Parameters of the search job that initiated this table.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
totalRetentionInDays	integer	The table total retention in days, between 4 and 4383. Setting this property to -1 will default to retentionInDays.
totalRetentionInDaysAsDefault	boolean	True - Value originates from retention in days, False - Customer specific.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, table_name, subscription_id		Gets a Log Analytics workspace table.
list_by_workspace	select	resource_group_name, workspace_name, subscription_id		Gets all the tables for the specified Log Analytics workspace.
create_or_update	insert	resource_group_name, workspace_name, table_name, subscription_id		Update or Create a Log Analytics workspace table.
update	update	resource_group_name, workspace_name, table_name, subscription_id		Update a Log Analytics workspace table.
create_or_update	replace	resource_group_name, workspace_name, table_name, subscription_id		Update or Create a Log Analytics workspace table.
delete	delete	resource_group_name, workspace_name, table_name, subscription_id		Delete a Log Analytics workspace table.
migrate	exec	resource_group_name, workspace_name, table_name, subscription_id		Migrate a Log Analytics table from support of the Data Collector API and Custom Fields features to support of Data Collection Rule-based Custom Logs.
cancel_search	exec	resource_group_name, workspace_name, table_name, subscription_id		Cancel a log analytics workspace search results table query run.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
table_name	string	The name of the table. Required.
workspace_name	string	The name of the workspace. Required.

SELECT examples

get

Gets a Log Analytics workspace table.

SELECT
id,
name,
archiveRetentionInDays,
lastPlanModifiedDate,
plan,
provisioningState,
restoredLogs,
resultStatistics,
retentionInDays,
retentionInDaysAsDefault,
schema,
searchResults,
systemData,
totalRetentionInDays,
totalRetentionInDaysAsDefault,
type
FROM azure.log_analytics.tables
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND table_name = '{{ table_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_workspace

Gets all the tables for the specified Log Analytics workspace.

SELECT
id,
name,
archiveRetentionInDays,
lastPlanModifiedDate,
plan,
provisioningState,
restoredLogs,
resultStatistics,
retentionInDays,
retentionInDaysAsDefault,
schema,
searchResults,
systemData,
totalRetentionInDays,
totalRetentionInDaysAsDefault,
type
FROM azure.log_analytics.tables
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Update or Create a Log Analytics workspace table.

INSERT INTO azure.log_analytics.tables (
properties,
resource_group_name,
workspace_name,
table_name,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ table_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: tables
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the tables resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the tables resource.
  - name: table_name
    value: "{{ table_name }}"
    description: Required parameter for the tables resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the tables resource.
  - name: properties
    description: |
      Table's properties.
    value:
      retentionInDays: {{ retentionInDays }}
      totalRetentionInDays: {{ totalRetentionInDays }}
      archiveRetentionInDays: {{ archiveRetentionInDays }}
      searchResults:
        query: "{{ query }}"
        description: "{{ description }}"
        limit: {{ limit }}
        startSearchTime: "{{ startSearchTime }}"
        endSearchTime: "{{ endSearchTime }}"
        sourceTable: "{{ sourceTable }}"
        azureAsyncOperationId: "{{ azureAsyncOperationId }}"
      restoredLogs:
        startRestoreTime: "{{ startRestoreTime }}"
        endRestoreTime: "{{ endRestoreTime }}"
        sourceTable: "{{ sourceTable }}"
        azureAsyncOperationId: "{{ azureAsyncOperationId }}"
      resultStatistics:
        progress: {{ progress }}
        ingestedRecords: {{ ingestedRecords }}
        scannedGb: {{ scannedGb }}
      plan: "{{ plan }}"
      lastPlanModifiedDate: "{{ lastPlanModifiedDate }}"
      schema:
        name: "{{ name }}"
        displayName: "{{ displayName }}"
        description: "{{ description }}"
        columns:
          - name: "{{ name }}"
            type: "{{ type }}"
            dataTypeHint: "{{ dataTypeHint }}"
            displayName: "{{ displayName }}"
            description: "{{ description }}"
            isDefaultDisplay: {{ isDefaultDisplay }}
            isHidden: {{ isHidden }}
        standardColumns:
          - name: "{{ name }}"
            type: "{{ type }}"
            dataTypeHint: "{{ dataTypeHint }}"
            displayName: "{{ displayName }}"
            description: "{{ description }}"
            isDefaultDisplay: {{ isDefaultDisplay }}
            isHidden: {{ isHidden }}
        categories:
          - "{{ categories }}"
        labels:
          - "{{ labels }}"
        source: "{{ source }}"
        tableType: "{{ tableType }}"
        tableSubType: "{{ tableSubType }}"
        solutions:
          - "{{ solutions }}"
      provisioningState: "{{ provisioningState }}"
      retentionInDaysAsDefault: {{ retentionInDaysAsDefault }}
      totalRetentionInDaysAsDefault: {{ totalRetentionInDaysAsDefault }}

UPDATE examples

update

Update a Log Analytics workspace table.

UPDATE azure.log_analytics.tables
SET 
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND table_name = '{{ table_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

REPLACE examples

create_or_update

Update or Create a Log Analytics workspace table.

REPLACE azure.log_analytics.tables
SET 
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND table_name = '{{ table_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Delete a Log Analytics workspace table.

DELETE FROM azure.log_analytics.tables
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND table_name = '{{ table_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;

Lifecycle Methods

migrate

Migrate a Log Analytics table from support of the Data Collector API and Custom Fields features to support of Data Collection Rule-based Custom Logs.

EXEC azure.log_analytics.tables.migrate 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@table_name='{{ table_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;

cancel_search

Cancel a log analytics workspace search results table query run.

EXEC azure.log_analytics.tables.cancel_search 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@table_name='{{ table_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;