Azure Monitor 中的示例数据收集规则 (DCR)
本文介绍了不同场景下的示例数据收集规则 (DCR)。 有关这些 DCR 中每种属性的说明，请参阅数据收集规则结构。
注意
如果使用 ARM 模板或 REST API 创建或修改 DCR，则这些示例提供 DCR 的源 JSON。 创建后，DCR 将具有“Azure Monitor 中数据收集规则结构”中所述的其他属性。
Azure Monitor 代理 - 事件和性能数据
以下示例数据收集规则适用于具有 Azure Monitor 代理的虚拟机，并提供以下详细信息：
- 性能数据
- 每 15 秒收集一次特定处理器、内存、逻辑磁盘和物理磁盘计数器，且每分钟上传一次。
- 每 30 秒收集一次特定进程计数器，且每 5 分钟上传一次。
- Windows 事件
- 收集 Windows 安全事件，且每分钟上传一次。
- 收集 Windows 应用程序和系统事件，且每 5 分钟上传一次。
- Syslog
- 从 cron 设备收集调试、严重和紧急事件。
- 从 syslog 设备收集警报、严重和紧急事件。
- Destinations
- 将所有数据发送到名为 centralWorkspace 的 Log Analytics 工作区。
注意
有关用于在数据收集规则中指定事件收集的 XPath 的说明，请参阅使用自定义 XPath 查询限制数据收集。
{
"location": "chinaeast2",
"properties": {
"dataSources": {
"performanceCounters": [
{
"name": "cloudTeamCoreCounters",
"streams": [
"Microsoft-Perf"
],
"scheduledTransferPeriod": "PT1M",
"samplingFrequencyInSeconds": 15,
"counterSpecifiers": [
"\\Processor(_Total)\\% Processor Time",
"\\Memory\\Committed Bytes",
"\\LogicalDisk(_Total)\\Free Megabytes",
"\\PhysicalDisk(_Total)\\Avg. Disk Queue Length"
]
},
{
"name": "appTeamExtraCounters",
"streams": [
"Microsoft-Perf"
],
"scheduledTransferPeriod": "PT5M",
"samplingFrequencyInSeconds": 30,
"counterSpecifiers": [
"\\Process(_Total)\\Thread Count"
]
}
],
"windowsEventLogs": [
{
"name": "cloudSecurityTeamEvents",
"streams": [
"Microsoft-Event"
],
"scheduledTransferPeriod": "PT1M",
"xPathQueries": [
"Security!*"
]
},
{
"name": "appTeam1AppEvents",
"streams": [
"Microsoft-Event"
],
"scheduledTransferPeriod": "PT5M",
"xPathQueries": [
"System!*[System[(Level = 1 or Level = 2 or Level = 3)]]",
"Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]"
]
}
],
"syslog": [
{
"name": "cronSyslog",
"streams": [
"Microsoft-Syslog"
],
"facilityNames": [
"cron"
],
"logLevels": [
"Debug",
"Critical",
"Emergency"
]
},
{
"name": "syslogBase",
"streams": [
"Microsoft-Syslog"
],
"facilityNames": [
"syslog"
],
"logLevels": [
"Alert",
"Critical",
"Emergency"
]
}
]
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
"name": "centralWorkspace"
}
]
},
"dataFlows": [
{
"streams": [
"Microsoft-Perf",
"Microsoft-Syslog",
"Microsoft-Event"
],
"destinations": [
"centralWorkspace"
]
}
]
}
}
Azure Monitor 代理 - 文本日志
以下示例数据收集规则用于收集使用 Azure Monitor 代理的文本日志。 请注意，自定义文本日志的流名称应以“Custom-”前缀开头。
{
"location": "chinaeast2",
"properties": {
"streamDeclarations": {
"Custom-MyLogFileFormat": {
"columns": [
{
"name": "TimeGenerated",
"type": "datetime"
},
{
"name": "RawData",
"type": "string"
}
]
}
},
"dataSources": {
"logFiles": [
{
"streams": [
"Custom-MyLogFileFormat"
],
"filePatterns": [
"C:\\JavaLogs\\*.log"
],
"format": "text",
"settings": {
"text": {
"recordStartTimestampFormat": "ISO 8601"
}
},
"name": "myLogFileFormat-Windows"
},
{
"streams": [
"Custom-MyLogFileFormat"
],
"filePatterns": [
"//var//*.log"
],
"format": "text",
"settings": {
"text": {
"recordStartTimestampFormat": "ISO 8601"
}
},
"name": "myLogFileFormat-Linux"
}
]
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
"name": "MyDestination"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-MyLogFileFormat"
],
"destinations": [
"MyDestination"
],
"transformKql": "source",
"outputStream": "Custom-MyTable_CL"
}
]
}
}
日志引入 API
以下示例数据收集规则用于与日志引入 API 一起使用。 它包含以下详细信息：
- 将数据发送到名为“my-workspace”的工作区中名为“MyTable_CL”的表。
- 将转换应用于传入数据。
注意
日志引入 API 需要 logsIngestion 属性，其中包括终结点的 URL。 此属性在创建后添加到 DCR。
{
"location": "chinaeast2",
"kind": "Direct",
"properties": {
"streamDeclarations": {
"Custom-MyTable": {
"columns": [
{
"name": "Time",
"type": "datetime"
},
{
"name": "Computer",
"type": "string"
},
{
"name": "AdditionalContext",
"type": "string"
}
]
}
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cefingestion/providers/microsoft.operationalinsights/workspaces/my-workspace",
"name": "LogAnalyticsDest"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-MyTable"
],
"destinations": [
"LogAnalyticsDest"
],
"transformKql": "source | extend jsonContext = parse_json(AdditionalContext) | project TimeGenerated = Time, Computer, AdditionalContext = jsonContext, ExtendedColumn=tostring(jsonContext.CounterName)",
"outputStream": "Custom-MyTable_CL"
}
]
}
}
工作区转换 DCR
以下示例数据收集规则用作工作区转换 DCR 来转换发送到名为“LAQueryLogs”表中的所有数据。
{
"location": "chinaeast2",
"properties": {
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
"name": "clv2ws1"
}
]
},
"dataFlows": [
{
"streams": [
"Microsoft-Table-LAQueryLogs"
],
"destinations": [
"clv2ws1"
],
"transformKql": "source |where QueryText !contains 'LAQueryLogs' | extend Context = parse_json(RequestContext) | extend Resources_CF = tostring(Context['workspaces']) |extend RequestContext = ''"
}
]
}
}