Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Azure portal provides a simplified experience for creating a data collection rule (DCR) for particular scenarios. Using this method, you don't need to understand the structure of a DCR, although you may be limited in the configuration you can perform and may need to later edit the DCR definition to implement an advanced feature such as a transformation.
Note
To create a DCR by editing its JSON definition, see Create data collection rules (DCRs) using JSON.
Permissions
You require the following permissions to create DCRs and DCR associations:
| Built-in role | Scopes | Reason |
|---|---|---|
| Monitoring Contributor |
|
Create or edit DCRs, assign rules to the machine, deploy associations. |
| Any role that includes the action Microsoft.Resources/deployments/* |
|
Deploy Azure Resource Manager templates. |
Important
Create your DCR in the same region as your destination Log Analytics workspace or Azure Monitor workspace. You can associate the DCR to machines or containers from any subscription or resource group in the tenant. To send data across tenants, you must first enable Azure Lighthouse.
Creating DCRs for different scenarios
The process for creating a DCR in the Azure portal varies depending on what type of data you're collecting and where you're collecting it from. In some cases, the DCR is created as part of a larger process such as enabling monitoring for a VM. In other cases, you create the DCR directly to configure specific data collection. The experience will vary for each scenario, so refer to the documentation for the specific scenario you're working with as described in the following sections.
Logs collection for virtual machines
To collect data from virtual machines, virtual machine scale sets, and Azure Arc-enabled servers, create a DCR in the Azure portal using a guided interface to select different data sources from the client operating system. Examples include Windows events, Syslog events, performance counters, OpenTelemetry metrics, and text logs. The Azure Monitor agent is automatically installed if necessary, and an association is created between the DCR and each VM you select.
See Collect data from virtual machine client with Azure Monitor.
Kubernetes monitoring
When you enable collection of logs and Prometheus metrics for a Kubernetes cluster, a DCR for each is created and associated with the containerized version of Azure Monitor agent in the cluster. You may need to modify the logs DCR to add a transformation.
See Enable monitoring for Kubernetes clusters and Data transformations in Container insights.
Custom tables
When you create a new table in a Log Analytics workspace using the Azure portal, you upload sample data that Azure Monitor uses to create a DCR, including a transformation, that can be used with the Logs Ingestion API. You can't modify this DCR in the Azure portal but can modify it using the methods described in Create data collection rules (DCRs) using JSON.
Workspace transformation DCR
Workspace transformation DCRs provide transformations for data collection scenarios that don't yet use DCRs. You can create this DCR by using the Azure portal to create a transformation for a particular table.
See Create workspace transformation DCR.