I'm intending to inject logs from Logic Apps to Log Analytics workspace. (Aim : Poll data from remote REST API and push them in Sentinel). I follow Microsoft Standard procedure as follows, keeping every resource in same region, same RG:
- Create Data Collection Endpoint
DCEMyTable
, - Create Log Analytics Workspace
LogAnalyticstodelete
, - Create new Data Collection Rule
DCRMyTable
bound toDCEMyTable
, - Add new table in Log Analytics Workspace
MyTable_CL
bound toDCRMyTable
andDCEMyTable
, adding a very simple JSON:
{
"Time": "2023-11-06T07:34:00Z",
"Value": "passed"
}
- Transform it w/ KQL:
source| project-rename TimeGenerated = Time
and validate - Create an Action in Logic Apps : "Log Analytics Data Collector API" as follows:
I used Workspace ID & Key found in Linux Agents of my LogAnalytics Workspace to connect, maybe it's the buggy move.
When fired, Logic Apps yields a HTTP 200 code, but no log seems inserted in Log Analytics. Did some of you tried this usecase successfully?
If you have a Consumption Logic app, then you can use both Windows and Linux Agent Workspace ID and Workspace Key to create a connection to log analytics workspace. But If you have a Standard Logic app then you need to use only Windows Agent Workspace ID and Workspace Key.
I am able to send the logs from a Consumption Logic app to log analytics workspace as shown below.
Logs in log analytics workspace-
Please try to wait for sometime if you are not able to see the logs instantly after logic app execution and refresh the page if needed. I believe you will also be able to get the logs alike me.