Set a table's log data plan to Basic or Analytics

Article
09/20/2024

Azure Monitor Logs offers two log data plans that let you reduce log ingestion and retention costs and take advantage of Azure Monitor's advanced features and analytics capabilities based on your needs:

The default Analytics log data plan provides full analysis capabilities and makes log data available for queries, Azure Monitor features, such as alerts, and use by other services.
The Basic log data plan lets you save on the cost of ingesting and storing high-volume verbose logs in your Log Analytics workspace for debugging, troubleshooting, and auditing, but not for analytics and alerts.

This article describes Azure Monitor's log data plans and explains how to configure the log data plan of the tables in your Log Analytics workspace.

Permissions

To set a table's log data plan, you must have at least contributor rights.

Compare the Basic and Analytics log data plans

The following table summarizes the Basic and Analytics log data plans.

Category	Analytics	Basic
Ingestion	Regular ingestion cost.	Reduced ingestion cost.
Log queries	Full query capabilities No extra cost.	Basic query capabilities. Pay-per-use.
Retention	Configure retention from 30 days to two years.	Retention fixed at thirty days. When you change an existing table's plan to Basic logs, Azure archives data that's more than thirty days old but still within the table's original retention period.
Alerts	Supported.	Not supported.

Note

The Basic log data plan isn't available for workspaces in legacy pricing tiers.

When should I use Basic logs?

By default, all tables in your Log Analytics workspace are Analytics tables, and they're available for query and alerts.

Configure a table for Basic logs if:

You don't require more than thirty days of data retention for the table.
The cost savings for data ingestion exceed the expected cost for any expected queries.
The table supports Basic logs.

Set a table's log data plan

When you change a table's plan from Analytics to Basic, Log Analytics immediately archives any data that's older than thirty days and up to original data retention of the table. In other words, the total retention period of the table remains unchanged, unless you explicitly modify the archive period.

When you change a table's plan from Basic to Analytics, the changes take affect on existing data in the table immediately.

Note

You can switch a table's plan once a week.

To configure a table for Basic logs or Analytics logs in the Azure portal:

From the Log Analytics workspaces menu, select Tables.

The Tables screen lists all the tables in the workspace.
Select the context menu for the table you want to configure and select Manage table.
From the Table plan dropdown on the table configuration screen, select Basic or Analytics.

The Table plan dropdown is enabled only for tables that support Basic logs.
Select Save.

To configure a table for Basic logs or Analytics logs, call the Tables - Update API:

PATCH https://management.chinacloudapi.cn/subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/tables/<tableName>?api-version=2021-12-01-preview

Important

Use the bearer token for authentication. Learn more about using bearer tokens.

Request body

Name	Type	Description
properties.plan	string	The table plan. Possible values are `Analytics` and `Basic`.

Example

This example configures the ContainerLogV2 table for Basic logs.

Container insights uses ContainerLog by default. To switch to using ContainerLogV2 for Container insights, enable the ContainerLogV2 schema before you convert the table to Basic logs.

Sample request

PATCH https://management.chinacloudapi.cn/subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace/tables/ContainerLogV2?api-version=2021-12-01-preview

Use this request body to change to Basic logs:

{
    "properties": {
        "plan": "Basic"
    }
}

Use this request body to change to Analytics Logs:

{
    "properties": {
        "plan": "Analytics"
    }
}

Sample response

This sample is the response for a table changed to Basic logs:

Status code: 200

{
    "properties": {
        "retentionInDays": 30,
        "totalRetentionInDays": 30,
        "archiveRetentionInDays": 22,
        "plan": "Basic",
        "lastPlanModifiedDate": "2022-01-01T14:34:04.37",
        "schema": {...}        
    },
    "id": "subscriptions/ContosoSID/resourcegroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/ContosoWorkspace",
    "name": "ContainerLogV2"
}

To configure a table for Basic logs or Analytics logs, run the az monitor log-analytics workspace table update command and set the --plan parameter to Basic or Analytics.

For example:

To set Basic logs:

az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLogV2  --plan Basic

To set Analytics Logs:

az monitor log-analytics workspace table update --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name ContainerLogV2  --plan Analytics

To configure a table's log data plan, use the Update-AzOperationalInsightsTable cmdlet:

Update-AzOperationalInsightsTable  -ResourceGroupName RG-NAME -WorkspaceName WORKSPACE-NAME -Plan Basic|Analytics

Supported tables

These tables currently support Basic logs:

All custom tables created with or migrated to the data collection rule (DCR)-based logs ingestion API..

Service	Table
Azure Active Directory	AADDomainServicesDNSAuditsGeneral AADDomainServicesDNSAuditsDynamicUpdates AADServicePrincipalSignInLogs
Azure Load Balancing	ALBHealthEvent
Azure Databricks	DatabricksBrickStoreHttpGateway DatabricksDataMonitoring DatabricksFilesystem DatabricksDashboards DatabricksCloudStorageMetadata DatabricksPredictiveOptimization DatabricksIngestion DatabricksMarketplaceConsumer DatabricksLineageTracking
API Management	ApiManagementGatewayLogs ApiManagementWebSocketConnectionLogs
API Management Service	APIMDevPortalAuditDiagnosticLog
Application Gateways	AGWAccessLogs AGWPerformanceLogs AGWFirewallLogs
Application Gateway for Containers	AGCAccessLogs
Application Insights	AppTraces
Bare Metal Machines	NCBMSecurityDefenderLogs NCBMSystemLogs NCBMSecurityLogs NCBMBreakGlassAuditLogs
Chaos Experiments	ChaosStudioExperimentEventLogs
Cloud HSM	CHSMManagementAuditLogs
Cluster Managers (Operator Nexus)	NCMClusterOperationsLogs
Container Apps	ContainerAppConsoleLogs
Container Insights	ContainerLogV2
Container Apps Environments	AppEnvSpringAppConsoleLogs
Communication Services	ACSAdvancedMessagingOperations ACSCallAutomationIncomingOperations ACSCallAutomationMediaSummary ACSCallClientMediaStatsTimeSeries ACSCallClientOperations ACSCallRecordingIncomingOperations ACSCallRecordingSummary ACSCallSummary ACSJobRouterIncomingOperations ACSRoomsIncomingOperations ACSCallClosedCaptionsSummary
Confidential Ledgers	CCFApplicationLogs
Cosmos DB	CDBDataPlaneRequests CDBPartitionKeyStatistics CDBPartitionKeyRUConsumption CDBQueryRuntimeStatistics CDBMongoRequests CDBCassandraRequests CDBGremlinRequests CDBControlPlaneRequests
Cosmos DB for MongoDB (vCore)	VCoreMongoRequests
Kubernetes clusters - Azure Arc	ArcK8sAudit ArcK8sAuditAdmin ArcK8sControlPlane
Data Manager for Energy	OEPDataplaneLogs
Dedicated SQL Pool	SynapseSqlPoolSqlRequests SynapseSqlPoolRequestSteps SynapseSqlPoolExecRequests SynapseSqlPoolDmsWorkers SynapseSqlPoolWaits
DNS Security Policies	DNSQueryLogs
Dev Centers	DevCenterDiagnosticLogs DevCenterResourceOperationLogs DevCenterBillingEventLogs
Data Transfer	DataTransferOperations
Event Hubs	AZMSArchiveLogs AZMSAutoscaleLogs AZMSCustomerManagedKeyUserLogs AZMSKafkaCoordinatorLogs AZMSKafkaUserErrorLogs
Firewalls	AZFWFlowTrace
Health Care APIs	AHDSMedTechDiagnosticLogs AHDSDicomDiagnosticLogs AHDSDicomAuditLogs
Key Vault	AZKVAuditLogs AZKVPolicyEvaluationDetailsLogs
Kubernetes services	AKSAudit AKSAuditAdmin AKSControlPlane
Log Analytics	LASummaryLogs
Managed Lustre	AFSAuditLogs
Managed NGINX	NGXOperationLogs NGXSecurityLogs
Media Services	AMSLiveEventOperations AMSKeyDeliveryRequests AMSMediaAccountHealth AMSStreamingEndpointRequests
Microsoft Graph	MicrosoftGraphActivityLogs
Monitor	AzureMetricsV2
Network Devices (Operator Nexus)	MNFDeviceUpdates MNFSystemStateMessageUpdates
Network Managers	AVNMConnectivityConfigurationChange AVNMIPAMPoolAllocationChange
Nexus Clusters	NCCKubernetesLogs NCCVMOrchestrationLogs
Nexus Storage Appliances	NCSStorageLogs NCSStorageAlerts
Operator Insights - Data Products	AOIDatabaseQuery AOIDigestion AOIStorage
Redis cache	ACRConnectedClientList
Redis Cache Enterprise	REDConnectionEvents
Relays	AZMSHybridConnectionsEvents
Security	SecurityAttackPathData MDCFileIntegrityMonitoringEvents
Service Bus	AZMSApplicationMetricLogs AZMSOperationalLogs AZMSRunTimeAuditLogs AZMSVNetConnectionEvents
Sphere	ASCAuditLogs ASCDeviceEvents
Storage	StorageBlobLogs StorageFileLogs StorageQueueLogs StorageTableLogs
Synapse Analytics	SynapseSqlPoolExecRequests SynapseSqlPoolRequestSteps SynapseSqlPoolDmsWorkers SynapseSqlPoolWaits
Storage Mover	StorageMoverJobRunLogs StorageMoverCopyLogsFailed StorageMoverCopyLogsTransferred
Virtual Network Manager	AVNMNetworkGroupMembershipChange AVNMRuleCollectionChange

Note

Tables created with the Data Collector API don't support Basic logs.

Set a table's log data plan to Basic or Analytics

Permissions

Compare the Basic and Analytics log data plans

When should I use Basic logs?

Set a table's log data plan

Supported tables

Next steps

Additional resources