flow_logs

Creates, updates, deletes, gets or lists a flow_logs resource.

Overview

Name	flow_logs
Type	Resource
Id	azure.network.flow_logs

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Resource ID.
name	string	Resource name.
enabled	boolean	Flag to enable/disable flow logging.
enabledFilteringCriteria	string	Optional field to filter network traffic logs based on SrcIP, SrcPort, DstIP, DstPort, Protocol, Encryption, Direction and Action. If not specified, all network traffic will be logged.
etag	string	A unique read-only string that changes whenever the resource is updated.
flowAnalyticsConfiguration	object	Parameters that define the configuration of traffic analytics.
format	object	Parameters that define the flow log format.
identity	object	FlowLog resource Managed Identity.
location	string	Resource location.
provisioningState	string	The provisioning state of the flow log. Known values are: "Failed", "Succeeded", "Canceled", "Creating", "Updating", and "Deleting". (Failed, Succeeded, Canceled, Creating, Updating, Deleting)
recordTypes	string	Optional field to filter network traffic logs based on flow states. Value of this field could be any comma separated combination string of letters B,C,E or D. B represents Begin, when a flow is created. C represents Continue for an ongoing flow generated at every five-minute interval. E represents End, when a flow is terminated. D represents Deny, when a flow is denied. If not specified, all network traffic will be logged.
retentionPolicy	object	Parameters that define the retention policy for flow log.
storageId	string	ID of the storage account which is used to store the flow log. Required.
tags	object	Resource tags.
targetResourceGuid	string	Guid of network security group to which flow log will be applied.
targetResourceId	string	ID of network security group to which flow log will be applied. Required.
type	string	Resource type.

list

Name	Datatype	Description
id	string	Resource ID.
name	string	Resource name.
enabled	boolean	Flag to enable/disable flow logging.
enabledFilteringCriteria	string	Optional field to filter network traffic logs based on SrcIP, SrcPort, DstIP, DstPort, Protocol, Encryption, Direction and Action. If not specified, all network traffic will be logged.
etag	string	A unique read-only string that changes whenever the resource is updated.
flowAnalyticsConfiguration	object	Parameters that define the configuration of traffic analytics.
format	object	Parameters that define the flow log format.
identity	object	FlowLog resource Managed Identity.
location	string	Resource location.
provisioningState	string	The provisioning state of the flow log. Known values are: "Failed", "Succeeded", "Canceled", "Creating", "Updating", and "Deleting". (Failed, Succeeded, Canceled, Creating, Updating, Deleting)
recordTypes	string	Optional field to filter network traffic logs based on flow states. Value of this field could be any comma separated combination string of letters B,C,E or D. B represents Begin, when a flow is created. C represents Continue for an ongoing flow generated at every five-minute interval. E represents End, when a flow is terminated. D represents Deny, when a flow is denied. If not specified, all network traffic will be logged.
retentionPolicy	object	Parameters that define the retention policy for flow log.
storageId	string	ID of the storage account which is used to store the flow log. Required.
tags	object	Resource tags.
targetResourceGuid	string	Guid of network security group to which flow log will be applied.
targetResourceId	string	ID of network security group to which flow log will be applied. Required.
type	string	Resource type.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, network_watcher_name, flow_log_name, subscription_id		Gets a flow log resource by name.
list	select	resource_group_name, network_watcher_name, subscription_id		Lists all flow log resources for the specified Network Watcher.
create_or_update	insert	resource_group_name, network_watcher_name, flow_log_name, subscription_id		Create or update a flow log for the specified network security group.
update_tags	update	resource_group_name, network_watcher_name, flow_log_name, subscription_id		Update tags of the specified flow log.
create_or_update	replace	resource_group_name, network_watcher_name, flow_log_name, subscription_id		Create or update a flow log for the specified network security group.
delete	delete	resource_group_name, network_watcher_name, flow_log_name, subscription_id		Deletes the specified flow log resource.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
flow_log_name	string	The name of the flow log resource. Required.
network_watcher_name	string	The name of the network watcher. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string

SELECT examples

get

Gets a flow log resource by name.

SELECT
id,
name,
enabled,
enabledFilteringCriteria,
etag,
flowAnalyticsConfiguration,
format,
identity,
location,
provisioningState,
recordTypes,
retentionPolicy,
storageId,
tags,
targetResourceGuid,
targetResourceId,
type
FROM azure.network.flow_logs
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND network_watcher_name = '{{ network_watcher_name }}' -- required
AND flow_log_name = '{{ flow_log_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Lists all flow log resources for the specified Network Watcher.

SELECT
id,
name,
enabled,
enabledFilteringCriteria,
etag,
flowAnalyticsConfiguration,
format,
identity,
location,
provisioningState,
recordTypes,
retentionPolicy,
storageId,
tags,
targetResourceGuid,
targetResourceId,
type
FROM azure.network.flow_logs
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND network_watcher_name = '{{ network_watcher_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Create or update a flow log for the specified network security group.

INSERT INTO azure.network.flow_logs (
id,
location,
tags,
properties,
identity,
resource_group_name,
network_watcher_name,
flow_log_name,
subscription_id
)
SELECT 
'{{ id }}',
'{{ location }}',
'{{ tags }}',
'{{ properties }}',
'{{ identity }}',
'{{ resource_group_name }}',
'{{ network_watcher_name }}',
'{{ flow_log_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
identity,
location,
properties,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: flow_logs
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the flow_logs resource.
  - name: network_watcher_name
    value: "{{ network_watcher_name }}"
    description: Required parameter for the flow_logs resource.
  - name: flow_log_name
    value: "{{ flow_log_name }}"
    description: Required parameter for the flow_logs resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the flow_logs resource.
  - name: id
    value: "{{ id }}"
    description: |
      Resource ID.
  - name: location
    value: "{{ location }}"
    description: |
      Resource location.
  - name: tags
    value: "{{ tags }}"
    description: |
      Resource tags.
  - name: properties
    description: |
      Properties of the flow log.
    value:
      targetResourceId: "{{ targetResourceId }}"
      targetResourceGuid: "{{ targetResourceGuid }}"
      storageId: "{{ storageId }}"
      enabledFilteringCriteria: "{{ enabledFilteringCriteria }}"
      recordTypes: "{{ recordTypes }}"
      enabled: {{ enabled }}
      retentionPolicy:
        days: {{ days }}
        enabled: {{ enabled }}
      format:
        type: "{{ type }}"
        version: {{ version }}
      flowAnalyticsConfiguration:
        networkWatcherFlowAnalyticsConfiguration:
          enabled: {{ enabled }}
          workspaceId: "{{ workspaceId }}"
          workspaceRegion: "{{ workspaceRegion }}"
          workspaceResourceId: "{{ workspaceResourceId }}"
          trafficAnalyticsInterval: {{ trafficAnalyticsInterval }}
      provisioningState: "{{ provisioningState }}"
  - name: identity
    description: |
      FlowLog resource Managed Identity.
    value:
      principalId: "{{ principalId }}"
      tenantId: "{{ tenantId }}"
      type: "{{ type }}"
      userAssignedIdentities: "{{ userAssignedIdentities }}"

UPDATE examples

update_tags

Update tags of the specified flow log.

UPDATE azure.network.flow_logs
SET 
tags = '{{ tags }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND network_watcher_name = '{{ network_watcher_name }}' --required
AND flow_log_name = '{{ flow_log_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
identity,
location,
properties,
tags,
type;

REPLACE examples

create_or_update

Create or update a flow log for the specified network security group.

REPLACE azure.network.flow_logs
SET 
id = '{{ id }}',
location = '{{ location }}',
tags = '{{ tags }}',
properties = '{{ properties }}',
identity = '{{ identity }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND network_watcher_name = '{{ network_watcher_name }}' --required
AND flow_log_name = '{{ flow_log_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
identity,
location,
properties,
tags,
type;

DELETE examples

delete

Deletes the specified flow log resource.

DELETE FROM azure.network.flow_logs
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND network_watcher_name = '{{ network_watcher_name }}' --required
AND flow_log_name = '{{ flow_log_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;