data_collection_rules

Creates, updates, deletes, gets or lists a data_collection_rules resource.

Overview

Name	data_collection_rules
Type	Resource
Id	azure.monitor.data_collection_rules

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
agentSettings	object	Agent settings used to modify agent behavior on a given host.
dataCollectionEndpointId	string	The resource ID of the data collection endpoint that this rule can be used with.
dataFlows	array	The specification of data flows.
dataSources	object	The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.
description	string	Description of the data collection rule.
destinations	object	The specification of destinations.
directDataSources	object	The specification of direct data sources. This property is optional and can be omitted.
endpoints	object	Defines the ingestion endpoints to send data to via this rule.
etag	string	Resource entity tag (ETag).
identity	object	Managed service identity of the resource.
immutableId	string	The immutable ID of this data collection rule. This property is READ-ONLY.
ingestionQuotas	object	The specification for ingestion limits.
kind	string	The kind of the resource. Known values are: "Linux" and "Windows". (Linux, Windows)
location	string	The geo-location where the resource lives. Required.
metadata	object	Metadata about the resource.
provisioningState	string	The resource provisioning state. Known values are: "Creating", "Updating", "Deleting", "Succeeded", "Canceled", and "Failed". (Creating, Updating, Deleting, Succeeded, Canceled, Failed)
references	object	Defines all the references that may be used in other sections of the DCR.
sku	object	The SKU of the resource.
streamDeclarations	object	Declaration of custom streams used in this rule.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_by_resource_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
agentSettings	object	Agent settings used to modify agent behavior on a given host.
dataCollectionEndpointId	string	The resource ID of the data collection endpoint that this rule can be used with.
dataFlows	array	The specification of data flows.
dataSources	object	The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.
description	string	Description of the data collection rule.
destinations	object	The specification of destinations.
directDataSources	object	The specification of direct data sources. This property is optional and can be omitted.
endpoints	object	Defines the ingestion endpoints to send data to via this rule.
etag	string	Resource entity tag (ETag).
identity	object	Managed service identity of the resource.
immutableId	string	The immutable ID of this data collection rule. This property is READ-ONLY.
ingestionQuotas	object	The specification for ingestion limits.
kind	string	The kind of the resource. Known values are: "Linux" and "Windows". (Linux, Windows)
location	string	The geo-location where the resource lives. Required.
metadata	object	Metadata about the resource.
provisioningState	string	The resource provisioning state. Known values are: "Creating", "Updating", "Deleting", "Succeeded", "Canceled", and "Failed". (Creating, Updating, Deleting, Succeeded, Canceled, Failed)
references	object	Defines all the references that may be used in other sections of the DCR.
sku	object	The SKU of the resource.
streamDeclarations	object	Declaration of custom streams used in this rule.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_by_subscription

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
agentSettings	object	Agent settings used to modify agent behavior on a given host.
dataCollectionEndpointId	string	The resource ID of the data collection endpoint that this rule can be used with.
dataFlows	array	The specification of data flows.
dataSources	object	The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.
description	string	Description of the data collection rule.
destinations	object	The specification of destinations.
directDataSources	object	The specification of direct data sources. This property is optional and can be omitted.
endpoints	object	Defines the ingestion endpoints to send data to via this rule.
etag	string	Resource entity tag (ETag).
identity	object	Managed service identity of the resource.
immutableId	string	The immutable ID of this data collection rule. This property is READ-ONLY.
ingestionQuotas	object	The specification for ingestion limits.
kind	string	The kind of the resource. Known values are: "Linux" and "Windows". (Linux, Windows)
location	string	The geo-location where the resource lives. Required.
metadata	object	Metadata about the resource.
provisioningState	string	The resource provisioning state. Known values are: "Creating", "Updating", "Deleting", "Succeeded", "Canceled", and "Failed". (Creating, Updating, Deleting, Succeeded, Canceled, Failed)
references	object	Defines all the references that may be used in other sections of the DCR.
sku	object	The SKU of the resource.
streamDeclarations	object	Declaration of custom streams used in this rule.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, data_collection_rule_name, subscription_id		Returns the specified data collection rule. Returns the specified data collection rule.
list_by_resource_group	select	resource_group_name, subscription_id		Lists all data collection rules in the specified resource group. Lists all data collection rules in the specified resource group.
list_by_subscription	select	subscription_id		Lists all data collection rules in the specified subscription. Lists all data collection rules in the specified subscription.
create	insert	resource_group_name, data_collection_rule_name, subscription_id, location		Creates or updates a data collection rule. Creates or updates a data collection rule.
update	update	resource_group_name, data_collection_rule_name, subscription_id		Updates part of a data collection rule. Updates part of a data collection rule.
delete	delete	resource_group_name, data_collection_rule_name, subscription_id	deleteAssociations	Deletes a data collection rule. Deletes a data collection rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
data_collection_rule_name	string	The name of the data collection rule. The name is case insensitive. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
deleteAssociations	boolean	If set to 'true' then all associations of this data collection rule will also be deleted. Default value is None.

SELECT examples

get

Returns the specified data collection rule. Returns the specified data collection rule.

SELECT
id,
name,
agentSettings,
dataCollectionEndpointId,
dataFlows,
dataSources,
description,
destinations,
directDataSources,
endpoints,
etag,
identity,
immutableId,
ingestionQuotas,
kind,
location,
metadata,
provisioningState,
references,
sku,
streamDeclarations,
systemData,
tags,
type
FROM azure.monitor.data_collection_rules
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND data_collection_rule_name = '{{ data_collection_rule_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_resource_group

Lists all data collection rules in the specified resource group. Lists all data collection rules in the specified resource group.

SELECT
id,
name,
agentSettings,
dataCollectionEndpointId,
dataFlows,
dataSources,
description,
destinations,
directDataSources,
endpoints,
etag,
identity,
immutableId,
ingestionQuotas,
kind,
location,
metadata,
provisioningState,
references,
sku,
streamDeclarations,
systemData,
tags,
type
FROM azure.monitor.data_collection_rules
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_subscription

Lists all data collection rules in the specified subscription. Lists all data collection rules in the specified subscription.

SELECT
id,
name,
agentSettings,
dataCollectionEndpointId,
dataFlows,
dataSources,
description,
destinations,
directDataSources,
endpoints,
etag,
identity,
immutableId,
ingestionQuotas,
kind,
location,
metadata,
provisioningState,
references,
sku,
streamDeclarations,
systemData,
tags,
type
FROM azure.monitor.data_collection_rules
WHERE subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create

Creates or updates a data collection rule. Creates or updates a data collection rule.

INSERT INTO azure.monitor.data_collection_rules (
tags,
location,
properties,
kind,
sku,
identity,
resource_group_name,
data_collection_rule_name,
subscription_id
)
SELECT 
'{{ tags }}',
'{{ location }}' /* required */,
'{{ properties }}',
'{{ kind }}',
'{{ sku }}',
'{{ identity }}',
'{{ resource_group_name }}',
'{{ data_collection_rule_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
identity,
kind,
location,
properties,
sku,
systemData,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: data_collection_rules
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the data_collection_rules resource.
  - name: data_collection_rule_name
    value: "{{ data_collection_rule_name }}"
    description: Required parameter for the data_collection_rules resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the data_collection_rules resource.
  - name: tags
    value: "{{ tags }}"
    description: |
      Resource tags.
  - name: location
    value: "{{ location }}"
    description: |
      The geo-location where the resource lives. Required.
  - name: properties
    description: |
      :vartype properties: ~azure.mgmt.monitor.models.DataCollectionRuleResourceProperties
    value:
      description: "{{ description }}"
      immutableId: "{{ immutableId }}"
      dataCollectionEndpointId: "{{ dataCollectionEndpointId }}"
      metadata:
        provisionedBy: "{{ provisionedBy }}"
        provisionedByResourceId: "{{ provisionedByResourceId }}"
        provisionedByImmutableId: "{{ provisionedByImmutableId }}"
      endpoints:
        logsIngestion: "{{ logsIngestion }}"
        metricsIngestion: "{{ metricsIngestion }}"
      references:
        enrichmentData:
          storageBlobs:
            - resourceId: "{{ resourceId }}"
              blobUrl: "{{ blobUrl }}"
              lookupType: "{{ lookupType }}"
              name: "{{ name }}"
        applicationInsights:
          - resourceId: "{{ resourceId }}"
            name: "{{ name }}"
      agentSettings:
        logs:
          - name: "{{ name }}"
            value: "{{ value }}"
      streamDeclarations: "{{ streamDeclarations }}"
      dataSources:
        performanceCounters:
          - streams: "{{ streams }}"
            samplingFrequencyInSeconds: {{ samplingFrequencyInSeconds }}
            counterSpecifiers: "{{ counterSpecifiers }}"
            transformKql: "{{ transformKql }}"
            name: "{{ name }}"
        performanceCountersOTel:
          - streams: "{{ streams }}"
            samplingFrequencyInSeconds: {{ samplingFrequencyInSeconds }}
            counterSpecifiers: "{{ counterSpecifiers }}"
            name: "{{ name }}"
        windowsEventLogs:
          - streams: "{{ streams }}"
            xPathQueries: "{{ xPathQueries }}"
            transformKql: "{{ transformKql }}"
            name: "{{ name }}"
        syslog:
          - streams: "{{ streams }}"
            facilityNames: "{{ facilityNames }}"
            logLevels: "{{ logLevels }}"
            transformKql: "{{ transformKql }}"
            name: "{{ name }}"
        extensions:
          - streams: "{{ streams }}"
            extensionName: "{{ extensionName }}"
            extensionSettings: "{{ extensionSettings }}"
            inputDataSources: "{{ inputDataSources }}"
            name: "{{ name }}"
        logFiles:
          - streams: "{{ streams }}"
            filePatterns: "{{ filePatterns }}"
            format: "{{ format }}"
            settings:
              text:
                recordStartTimestampFormat: "{{ recordStartTimestampFormat }}"
            transformKql: "{{ transformKql }}"
            name: "{{ name }}"
        iisLogs:
          - streams: "{{ streams }}"
            logDirectories: "{{ logDirectories }}"
            transformKql: "{{ transformKql }}"
            name: "{{ name }}"
        windowsFirewallLogs:
          - streams: "{{ streams }}"
            profileFilter: "{{ profileFilter }}"
            name: "{{ name }}"
        prometheusForwarder:
          - streams: "{{ streams }}"
            labelIncludeFilter: "{{ labelIncludeFilter }}"
            customVMScrapeConfig: "{{ customVMScrapeConfig }}"
            name: "{{ name }}"
        platformTelemetry:
          - streams: "{{ streams }}"
            name: "{{ name }}"
        dataImports:
          eventHub:
            name: "{{ name }}"
            consumerGroup: "{{ consumerGroup }}"
            stream: "{{ stream }}"
        otelLogs:
          - streams: "{{ streams }}"
            resourceAttributeRouting:
              attributeName: "{{ attributeName }}"
              attributeValue: "{{ attributeValue }}"
            enrichWithResourceAttributes: "{{ enrichWithResourceAttributes }}"
            enrichWithReference: "{{ enrichWithReference }}"
            replaceResourceIdWithReference: {{ replaceResourceIdWithReference }}
            name: "{{ name }}"
        otelTraces:
          - streams: "{{ streams }}"
            resourceAttributeRouting:
              attributeName: "{{ attributeName }}"
              attributeValue: "{{ attributeValue }}"
            enrichWithResourceAttributes: "{{ enrichWithResourceAttributes }}"
            enrichWithReference: "{{ enrichWithReference }}"
            replaceResourceIdWithReference: {{ replaceResourceIdWithReference }}
            name: "{{ name }}"
        otelMetrics:
          - streams: "{{ streams }}"
            resourceAttributeRouting:
              attributeName: "{{ attributeName }}"
              attributeValue: "{{ attributeValue }}"
            enrichWithResourceAttributes: "{{ enrichWithResourceAttributes }}"
            enrichWithReference: "{{ enrichWithReference }}"
            name: "{{ name }}"
        etwProviders:
          - streams: "{{ streams }}"
            provider: "{{ provider }}"
            providerType: "{{ providerType }}"
            logLevel: "{{ logLevel }}"
            eventIds: "{{ eventIds }}"
            keyword: "{{ keyword }}"
            name: "{{ name }}"
      directDataSources:
        otelMetrics:
          - streams: "{{ streams }}"
            enrichWithResourceAttributes: "{{ enrichWithResourceAttributes }}"
            enrichWithReference: "{{ enrichWithReference }}"
            name: "{{ name }}"
        otelLogs:
          - streams: "{{ streams }}"
            enrichWithResourceAttributes: "{{ enrichWithResourceAttributes }}"
            enrichWithReference: "{{ enrichWithReference }}"
            replaceResourceIdWithReference: {{ replaceResourceIdWithReference }}
            name: "{{ name }}"
        otelTraces:
          - streams: "{{ streams }}"
            enrichWithResourceAttributes: "{{ enrichWithResourceAttributes }}"
            enrichWithReference: "{{ enrichWithReference }}"
            replaceResourceIdWithReference: {{ replaceResourceIdWithReference }}
            name: "{{ name }}"
      destinations:
        logAnalytics:
          - workspaceResourceId: "{{ workspaceResourceId }}"
            workspaceId: "{{ workspaceId }}"
            name: "{{ name }}"
        monitoringAccounts:
          - accountResourceId: "{{ accountResourceId }}"
            accountId: "{{ accountId }}"
            name: "{{ name }}"
        azureMonitorMetrics:
          name: "{{ name }}"
        eventHubs:
          - eventHubResourceId: "{{ eventHubResourceId }}"
            name: "{{ name }}"
        eventHubsDirect:
          - eventHubResourceId: "{{ eventHubResourceId }}"
            name: "{{ name }}"
        storageBlobsDirect:
          - containerName: "{{ containerName }}"
            storageAccountResourceId: "{{ storageAccountResourceId }}"
            name: "{{ name }}"
        storageTablesDirect:
          - tableName: "{{ tableName }}"
            storageAccountResourceId: "{{ storageAccountResourceId }}"
            name: "{{ name }}"
        storageAccounts:
          - containerName: "{{ containerName }}"
            storageAccountResourceId: "{{ storageAccountResourceId }}"
            name: "{{ name }}"
        microsoftFabric:
          - tenantId: "{{ tenantId }}"
            artifactId: "{{ artifactId }}"
            databaseName: "{{ databaseName }}"
            ingestionUri: "{{ ingestionUri }}"
            name: "{{ name }}"
        azureDataExplorer:
          - resourceId: "{{ resourceId }}"
            databaseName: "{{ databaseName }}"
            ingestionUri: "{{ ingestionUri }}"
            name: "{{ name }}"
      dataFlows:
        - streams: "{{ streams }}"
          destinations: "{{ destinations }}"
          transformKql: "{{ transformKql }}"
          outputStream: "{{ outputStream }}"
          builtInTransform: "{{ builtInTransform }}"
          captureOverflow: {{ captureOverflow }}
      ingestionQuotas:
        logs:
          maxSizePerMinuteInGB: "{{ maxSizePerMinuteInGB }}"
          maxRequestsPerMinute: "{{ maxRequestsPerMinute }}"
      provisioningState: "{{ provisioningState }}"
  - name: kind
    value: "{{ kind }}"
    description: |
      The kind of the resource. Known values are: "Linux" and "Windows".
    valid_values: ['Linux', 'Windows']
  - name: sku
    description: |
      The SKU of the resource.
    value:
      name: "{{ name }}"
      tier: "{{ tier }}"
      size: "{{ size }}"
      family: "{{ family }}"
      capacity: {{ capacity }}
  - name: identity
    description: |
      Managed service identity of the resource.
    value:
      principalId: "{{ principalId }}"
      tenantId: "{{ tenantId }}"
      type: "{{ type }}"
      userAssignedIdentities: "{{ userAssignedIdentities }}"

UPDATE examples

update

Updates part of a data collection rule. Updates part of a data collection rule.

UPDATE azure.monitor.data_collection_rules
SET 
tags = '{{ tags }}',
identity = '{{ identity }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND data_collection_rule_name = '{{ data_collection_rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
identity,
kind,
location,
properties,
sku,
systemData,
tags,
type;

DELETE examples

delete

Deletes a data collection rule. Deletes a data collection rule.

DELETE FROM azure.monitor.data_collection_rules
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND data_collection_rule_name = '{{ data_collection_rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
AND deleteAssociations = '{{ deleteAssociations }}'
;