Resource Manager template samples for Log Analytics workspaces in Azure Monitor

  • Article

This article includes sample Azure Resource Manager templates to create and configure Log Analytics workspaces in Azure Monitor. Each sample includes a template file and a parameters file with sample values to provide to the template.

Note

See Azure Resource Manager samples for Azure Monitor for a list of samples that are available and guidance on deploying them in your Azure subscription.

Prerequisites

Verify that your Azure subscription allows you to create Log Analytics workspaces in the target region.

Permissions required

Action Permissions required
Deploy ARM templates. Microsoft.Resources/deployments/* permissions, as provided by the Log Analytics Contributor built-in role, for example.
Create a Log Analytics workspace. Microsoft.OperationalInsights/workspaces/write permissions, as provided by the Log Analytics Contributor built-in role, for example.
Configure data collection for Log Analytics workspace. Microsoft.OperationalInsights/workspaces/write and Microsoft.OperationalInsights/workspaces/dataSources/write permissions, as provided by the Log Analytics Contributor built-in role, for example.

Template references

Create a Log Analytics workspace

The following sample creates a new empty Log Analytics workspace. A workspace has unique workspace ID and resource ID. You can reuse the same workspace name when in different resource groups.

Notes

  • If you specify a pricing tier of Free, then remove the retentionInDays element.

Template file

@description('Specify the name of the workspace.')
param workspaceName string

@description('Specify the location for the workspace.')
param location string

@description('Specify the pricing tier: PerGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers.')
@allowed([
  'CapacityReservation'
  'Free'
  'LACluster'
  'PerGB2018'
  'PerNode'
  'Premium'
  'Standalone'
  'Standard'
])
param sku string = 'PerGB2018'

@description('Specify the number of days to retain data.')
param retentionInDays int = 120

@description('Specify true to use resource or workspace permissions, or false to require workspace permissions.')
param resourcePermissions bool

@description('Specify the number of days to retain data in Heartbeat table.')
param heartbeatTableRetention int

resource workspace 'Microsoft.OperationalInsights/workspaces@2021-12-01-preview' = {
  name: workspaceName
  location: location
  properties: {
    sku: {
      name: sku
    }
    retentionInDays: retentionInDays
    features: {
      enableLogAccessUsingOnlyResourcePermissions: resourcePermissions
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2021-12-01-preview' = {
  parent: workspace
  name: 'Heartbeat'
  properties: {
    retentionInDays: heartbeatTableRetention
  }
}

Parameter file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "value": "MyWorkspace"
    },
    "sku": {
      "value": "PerGB2018"
    },
    "location": {
      "value": "chinaeast2"
    },
    "resourcePermissions": {
      "value": true
    },
    "heartbeatTableRetention": {
      "value": 30
    }
  }
}

Deploy the sample templates

See Deploy the sample templates.

Next steps