Create a Log Analytics workspace

Use the Log Analytics workspaces menu to create a workspace.

1. In the Azure portal, enter Log Analytics in the search box. As you begin typing, the list filters based on your input. Select Log Analytics workspaces.

   

2. Select Add.

3. Select a Subscription from the dropdown.

4. Use an existing Resource Group or create a new one.

5. Provide a name for the new Log Analytics workspace, such as DefaultLAWorkspace. This name must be unique per resource group.

6. Select an available Region. For more information, see which regions Log Analytics is available in. Search for Azure Monitor in the Search for a product box.

   

7. Select Review + Create to review the settings. Then select Create to create the workspace. A default pricing tier of pay-as-you-go is applied. No charges will be incurred until you start collecting enough data. For more information about other pricing tiers, see Log Analytics pricing details.

The following sample script creates a workspace with no data source configuration.

$ResourceGroup = <"my-resource-group">
$WorkspaceName = <"log-analytics-workspace-name">
$Location = <"chinaeast2">

# Create the resource group if needed
try {
    Get-AzResourceGroup -Name $ResourceGroup -ErrorAction Stop
} catch {
    New-AzResourceGroup -Name $ResourceGroup -Location $Location
}

# Create the workspace
New-AzOperationalInsightsWorkspace -Location $Location -Name $WorkspaceName -ResourceGroupName $ResourceGroup

After you've created a workspace, configure a Log Analytics workspace in Azure Monitor by using PowerShell.

Run the az group create command to create a resource group or use an existing resource group. To create a workspace, use the az monitor log-analytics workspace create command.

    az group create --name <myGroup> --location <myLocation>
    az monitor log-analytics workspace create --resource-group <myGroup> \
       --workspace-name <myWorkspace>

For more information about Azure Monitor Logs in Azure CLI, see Managing Azure Monitor Logs in Azure CLI.

The following sample uses Microsoft.OperationalInsights workspaces to create a Log Analytics workspace in Azure Monitor. For more information about Bicep, see Bicep overview.

@description('Name of the workspace.')
param workspaceName string

@description('Pricing tier: PerGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers.')
@allowed([
  'pergb2018'
  'Free'
  'Standalone'
  'PerNode'
  'Standard'
  'Premium'
])
param sku string = 'pergb2018'

@description('Specifies the location for the workspace.')
param location string

@description('Number of days to retain data.')
param retentionInDays int = 120

@description('true to use resource or workspace permissions. false to require workspace permissions.')
param resourcePermissions bool

@description('Number of days to retain data in Heartbeat table.')
param heartbeatTableRetention int

resource workspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: workspaceName
  location: location
  properties: {
    sku: {
      name: sku
    }
    retentionInDays: retentionInDays
    features: {
      enableLogAccessUsingOnlyResourcePermissions: resourcePermissions
    }
  }
}

resource workspaceName_Heartbeat 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  parent: workspace
  name: 'Heartbeat'
  properties: {
    retentionInDays: heartbeatTableRetention
  }
}

using './main.bicep'

param workspaceName = 'MyWorkspace'
param sku = 'pergb2018'
param location = 'chinanorth'
param retentionInDays = 120
param resourcePermissions = true
param heartbeatTableRetention = 30

The following sample uses the Microsoft.OperationalInsights workspaces template to create a Log Analytics workspace in Azure Monitor. For more information about Azure Resource Manager templates, see Azure Resource Manager templates.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "string",
      "metadata": {
        "description": "Name of the workspace."
      }
    },
    "sku": {
      "type": "string",
      "defaultValue": "pergb2018",
      "allowedValues": [
        "pergb2018",
        "Free",
        "Standalone",
        "PerNode",
        "Standard",
        "Premium"
      ],
      "metadata": {
        "description": "Pricing tier: PerGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
      }
    },
    "location": {
      "type": "string",
      "metadata": {
        "description": "Specifies the location for the workspace."
      }
    },
    "retentionInDays": {
      "type": "int",
      "defaultValue": 120,
      "metadata": {
        "description": "Number of days to retain data."
      }
    },
    "resourcePermissions": {
      "type": "bool",
      "metadata": {
        "description": "true to use resource or workspace permissions. false to require workspace permissions."
      }
    },
    "heartbeatTableRetention": {
      "type": "int",
      "metadata": {
        "description": "Number of days to retain data in Heartbeat table."
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces",
      "apiVersion": "2023-09-01",
      "name": "[parameters('workspaceName')]",
      "location": "[parameters('location')]",
      "properties": {
        "sku": {
          "name": "[parameters('sku')]"
        },
        "retentionInDays": "[parameters('retentionInDays')]",
        "features": {
          "enableLogAccessUsingOnlyResourcePermissions": "[parameters('resourcePermissions')]"
        }
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2022-10-01",
      "name": "[format('{0}/{1}', parameters('workspaceName'), 'Heartbeat')]",
      "properties": {
        "retentionInDays": "[parameters('heartbeatTableRetention')]"
      },
      "dependsOn": [
        "workspace"
      ]
    }
  ]
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "value": "MyWorkspace"
    },
    "sku": {
      "value": "pergb2018"
    },
    "location": {
      "value": "chinaeast2"
    },
    "resourcePermissions": {
      "value": true
    },
    "heartbeatTableRetention": {
      "value": 30
    }
  }
}