使用 Azure 资源管理器模板管理 Log Analytics 工作区Manage Log Analytics workspace using Azure Resource Manager templates

备注

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

可以使用 Azure 资源管理器模板在 Azure Monitor 中创建和配置 Log Analytics 工作区。You can use Azure Resource Manager templates to create and configure Log Analytics workspaces in Azure Monitor. 可使用模板执行的任务示例包括:Examples of the tasks you can perform with templates include:

  • 创建工作区,包括设置定价层和产能预留Create a workspace including setting pricing tier and capacity reservation
  • 添加解决方案Add a solution
  • 创建保存的搜索Create saved searches
  • 创建计算机组Create a computer group
  • 从装有 Windows 代理的计算机启用 IIS 日志收集Enable collection of IIS logs from computers with the Windows agent installed
  • 从 Linux 和 Windows 计算机中收集性能计数器Collect performance counters from Linux and Windows computers
  • 从 Linux 计算机的 syslog 中收集事件Collect events from syslog on Linux computers
  • 从 Windows 事件日志中收集事件Collect events from Windows event logs
  • 从 Windows 计算机收集自定义日志Collect custom logs from Windows computer
  • 将日志分析代理添加到 Azure 虚拟机Add the log analytics agent to an Azure virtual machine
  • 配置 Log Analytics 以便为使用 Azure 诊断收集的数据编制索引Configure log analytics to index data collected using Azure diagnostics

本文将提供模板示例,用于演示一些可以通过模板执行的配置。This article provides template samples that illustrate some of the configuration that you can perform with templates.

API 版本API versions

下表列出了此示例中使用的资源的 API 版本。The following table lists the API version for the resources used in this example.

资源Resource 资源类型Resource type API 版本API version
工作区Workspace workspacesworkspaces 2017-03-15-preview2017-03-15-preview
搜索Search savedSearchessavedSearches 2015-03-202015-03-20
数据源Data source datasourcesdatasources 2015-11-01-preview2015-11-01-preview
解决方案Solution solutionssolutions 2015-11-01-preview2015-11-01-preview

创建 Log Analytics 工作区Create a Log Analytics workspace

以下示例将使用本地计算机上的模板创建一个工作区。The following example creates a workspace using a template from your local machine. JSON 模板配置为仅需要新工作区的名称和位置。The JSON template is configured to only require the name and location of the new workspace. 它使用为其他工作区参数指定的值,例如访问控制模式、定价层、保留期和产能预留级别。It uses values specified for other workspace parameters such as access control mode, pricing tier, retention, and capacity reservation level.

警告

以下模板将创建一个 Log Analytics 工作区并配置数据收集。The following template creates a Log Analytics workspace and configures data collection. 这可能会更改计费设置。This may change your billing settings. 查看使用 Azure Monitor 日志管理使用情况和成本,以了解在 Azure 环境中应用计费设置之前在 Log Analytics 工作区中收集的数据的计费方式。Review Manage usage and costs with Azure Monitor Logs to understand billing for data collected in a Log Analytics workspace before applying it in your Azure environment.

对于产能预留,你可以通过指定 SKU CapacityReservation 并以 GB 为单位指定属性 capacityReservationLevel 的值来定义用于引入数据的选定产能预留。For capacity reservation, you define a selected capacity reservation for ingesting data by specifying the SKU CapacityReservation and a value in GB for the property capacityReservationLevel. 以下列表详细说明了在配置该功能时支持的值和行为。The following list details the supported values and behavior when configuring it.

  • 设置预留限制后,在 31 天内你不能更改为其他 SKU。Once you set the reservation limit, you cannot change to a different SKU within 31 days.

  • 设置预留值后,在 31 天内你只能增大该值。Once you set the reservation value, you can only increase it within 31 days.

  • 只能将 capacityReservationLevel 的值设置为 100 的倍数,最大值为 50000。You can only set the value of capacityReservationLevel in multiples of 100, with a maximum value of 50000.

  • 如果你增大了预留级别,则计时器将重置,并且在此更新后的 31 天内无法更改预留级别。If you increase the reservation level, the timer is reset and you cannot change it for another 31 days from this update.

  • 如果你修改了工作区的任何其他属性,但将预留限制保持为同一级别,则计时器不会重置。If you modify any other property for the workspace but retain the reservation limit to the same level, the timer is not reset.

创建和部署模板Create and deploy template

  1. 将以下 JSON 语法复制并粘贴到该文件中:Copy and paste the following JSON syntax into your file:

    {
    "$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
            "type": "String",
            "metadata": {
              "description": "Specifies the name of the workspace."
            }
        },
      "sku": {
        "type": "string",
        "allowedValues": [
          "pergb2018",
          "Free",
          "Standalone",
          "PerNode",
          "Standard",
          "Premium"
          ],
        "defaultValue": "pergb2018",
        "metadata": {
        "description": "Pricing tier: PerGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
        }
      },
      "location": {
        "type": "String",
        "allowedValues": [
        "chinaeast2" 
        ],
      "metadata": {
        "description": "Specifies the location in which to create the workspace."
        }
      }
    },
    "resources": [
        {
            "type": "Microsoft.OperationalInsights/workspaces",
            "name": "[parameters('workspaceName')]",
            "apiVersion": "2017-03-15-preview",
            "location": "[parameters('location')]",
            "properties": {
                "sku": {
                    "name": "[parameters('sku')]"
                },
                "retentionInDays": 120,
                "features": {
                    "searchVersion": 1,
                    "legacy": 0,
                    "enableLogAccessUsingOnlyResourcePermissions": true
                }
            }
          }
       ]
    }
    

    备注

    对于产能预留设置,请在“sku”下使用以下属性:For capacity reservation settings, use these properties under "sku":

    • "name":"CapacityReservation","name": "CapacityReservation",
    • "capacityReservationLevel":100"capacityReservationLevel": 100
  2. 按要求编辑模板。Edit the template to meet your requirements. 请考虑创建资源管理器参数文件,而不是将参数作为内联值传递。Consider creating a Resource Manager parameters file instead of passing parameters as inline values. 查看 Microsoft.OperationalInsights/workspaces 模板参考,了解支持的属性和值。Review Microsoft.OperationalInsights/workspaces template reference to learn what properties and values are supported.

  3. 在本地文件夹中将此文件另存为 deploylaworkspacetemplate.jsonSave this file as deploylaworkspacetemplate.json to a local folder.

  4. 已做好部署此模板的准备。You are ready to deploy this template. 使用 PowerShell 或命令行创建工作区,并在命令中指定工作区名称和位置。You use either PowerShell or the command line to create the workspace, specifying the workspace name and location as part of the command. 工作区名称在所有 Azure 订阅中必须全局唯一。The workspace name must be globally unique across all Azure subscriptions.

    • 对于 PowerShell,请在包含模板的文件夹中使用以下命令:For PowerShell use the following commands from the folder containing the template:

      New-AzResourceGroupDeployment -ResourceGroupName <resource-group-name> -TemplateFile deploylaworkspacetemplate.json -workspaceName <workspace-name> -location <location>
      
    • 对于命令行,请在包含模板的文件夹中使用以下命令:For command line, use the following commands from the folder containing the template:

      azure config mode arm
      azure group deployment create <my-resource-group> <my-deployment-name> --TemplateFile deploylaworkspacetemplate.json --workspaceName <workspace-name> --location <location>
      

部署可能需要几分钟才能完成。The deployment can take a few minutes to complete. 完成后,会看到一条包含结果的消息,如下所示:When it finishes, you see a message similar to the following that includes the result:

部署完成后的示例结果

配置 Log Analytics 工作区Configure a Log Analytics workspace

以下模板示例演示了如何:The following template sample illustrates how to:

  1. 向工作区添加解决方案Add solutions to the workspace
  2. 创建已保存搜索。Create saved searches. 若要确保部署不会意外地替代已保存搜索,应在“savedSearches”资源中添加 eTag 属性,以替代和保持已保存搜索的幂等性。To ensure that deployments don't override saved searches accidentally, an eTag property should be added in the "savedSearches" resource to override and maintain the idempotency of saved searches.
  3. 创建已保存函数。Create saved function. 应添加 eTag 以重写函数和保持幂等性。The eTag should be added to override function and maintain idempotency.
  4. 创建计算机组Create a computer group
  5. 从装有 Windows 代理的计算机启用 IIS 日志收集Enable collection of IIS logs from computers with the Windows agent installed
  6. 从 Linux 计算机中收集逻辑磁盘性能计数器 (% Used Inodes; Free Megabytes; % Used Space; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec)Collect Logical Disk perf counters from Linux computers (% Used Inodes; Free Megabytes; % Used Space; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec)
  7. 从 Linux 计算机中收集 syslog 事件Collect syslog events from Linux computers
  8. 从 Windows 计算机的应用程序事件日志中收集错误和警告事件Collect Error and Warning events from the Application Event Log from Windows computers
  9. 从 Windows 计算机中收集可用内存 (MB) 性能计数器Collect Memory Available Mbytes performance counter from Windows computers
  10. 收集由 Azure 诊断写入存储帐户的 IIS 日志和 Windows 事件日志Collect IIS logs and Windows Event logs written by Azure diagnostics to a storage account
  11. 从 Windows 计算机收集自定义日志Collect custom logs from Windows computer
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "string",
      "metadata": {
        "description": "Workspace name"
      }
    },
    "sku": {
      "type": "string",
      "allowedValues": [
        "PerGB2018",
        "Free",
        "Standalone",
        "PerNode",
        "Standard",
        "Premium"
      ],
      "defaultValue": "pergb2018",
      "metadata": {
        "description": "Pricing tier: pergb2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
      }
    },
    "dataRetention": {
      "type": "int",
      "defaultValue": 30,
      "minValue": 7,
      "maxValue": 730,
      "metadata": {
        "description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days."
      }
    },
    "immediatePurgeDataOn30Days": {
      "type": "bool",
      "defaultValue": "[bool('false')]",
      "metadata": {
        "description": "If set to true, changing retention to 30 days will immediately delete older data. Use this with extreme caution. This only applies when retention is being set to 30 days."
      }
    },
    "location": {
      "type": "string",
      "allowedValues": [
        "chinaeast2"
      ],
      "metadata": {
        "description": "Specifies the location in which to create the workspace."
      }
    },
    "applicationDiagnosticsStorageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Name of the storage account with Azure diagnostics output"
      }
    },
    "applicationDiagnosticsStorageAccountResourceGroup": {
      "type": "string",
      "metadata": {
        "description": "The resource group name containing the storage account with Azure diagnostics output"
      }
    },
    "customLogName": {
      "type": "string",
      "metadata": {
        "description": "The custom log name"
      }
    }
  },
  "variables": {
    "Updates": {
      "Name": "[Concat('Updates', '(', parameters('workspaceName'), ')')]",
      "GalleryName": "Updates"
    },
    "AntiMalware": {
      "Name": "[concat('AntiMalware', '(', parameters('workspaceName'), ')')]",
      "GalleryName": "AntiMalware"
    },
    "SQLAssessment": {
      "Name": "[Concat('SQLAssessment', '(', parameters('workspaceName'), ')')]",
      "GalleryName": "SQLAssessment"
    },
    "diagnosticsStorageAccount": "[resourceId(parameters('applicationDiagnosticsStorageAccountResourceGroup'), 'Microsoft.Storage/storageAccounts', parameters('applicationDiagnosticsStorageAccountName'))]"
  },
  "resources": [
    {
      "apiVersion": "2017-03-15-preview",
      "type": "Microsoft.OperationalInsights/workspaces",
      "name": "[parameters('workspaceName')]",
      "location": "[parameters('location')]",
      "properties": {
        "retentionInDays": "[parameters('dataRetention')]",
        "features": {
          "immediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]"
        },
        "sku": {
          "name": "[parameters('sku')]"
        }
      },
      "resources": [
        {
          "apiVersion": "2015-03-20",
          "name": "VMSS Queries2",
          "type": "savedSearches",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "properties": {
            "eTag": "*",
            "category": "VMSS",
            "displayName": "VMSS Instance Count",
            "query": "Event | where Source == \"ServiceFabricNodeBootstrapAgent\" | summarize AggregatedValue = count() by Computer",
            "version": 1
          }
        },
        {
          "apiVersion": "2017-04-26-preview",
          "name": "Cross workspace function",
          "type": "savedSearches",
            "dependsOn": [
             "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
            ],
            "properties": {
              "etag": "*",
              "displayName": "failedLogOnEvents",
              "category": "Security",
              "FunctionAlias": "failedlogonsecurityevents",
              "query": "
                union withsource=SourceWorkspace
                workspace('workspace1').SecurityEvent,
                workspace('workspace2').SecurityEvent,
                workspace('workspace3').SecurityEvent,
                | where EventID == 4625"
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleWindowsEvent1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "WindowsEvent",
          "properties": {
            "eventLogName": "Application",
            "eventTypes": [
              {
                "eventType": "Error"
              },
              {
                "eventType": "Warning"
              }
            ]
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleWindowsPerfCounter1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "WindowsPerformanceCounter",
          "properties": {
            "objectName": "Memory",
            "instanceName": "*",
            "intervalSeconds": 10,
            "counterName": "Available MBytes"
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleIISLog1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "IISLogs",
          "properties": {
            "state": "OnPremiseEnabled"
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleSyslog1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "LinuxSyslog",
          "properties": {
            "syslogName": "kern",
            "syslogSeverities": [
              {
                "severity": "emerg"
              },
              {
                "severity": "alert"
              },
              {
                "severity": "crit"
              },
              {
                "severity": "err"
              },
              {
                "severity": "warning"
              }
            ]
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleSyslogCollection1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "LinuxSyslogCollection",
          "properties": {
            "state": "Enabled"
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleLinuxPerf1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "LinuxPerformanceObject",
          "properties": {
            "performanceCounters": [
              {
                "counterName": "% Used Inodes"
              },
              {
                "counterName": "Free Megabytes"
              },
              {
                "counterName": "% Used Space"
              },
              {
                "counterName": "Disk Transfers/sec"
              },
              {
                "counterName": "Disk Reads/sec"
              },
              {
                "counterName": "Disk Writes/sec"
              }
            ],
            "objectName": "Logical Disk",
            "instanceName": "*",
            "intervalSeconds": 10
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "dataSources",
          "name": "[concat(parameters('workspaceName'), parameters('customLogName'))]",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', '/', parameters('workspaceName'))]"
          ],
          "kind": "CustomLog",
          "properties": {
            "customLogName": "[parameters('customLogName')]",
            "description": "this is a description",
            "extractions": [
              {
                "extractionName": "TimeGenerated",
                "extractionProperties": {
                  "dateTimeExtraction": {
                    "regex": [
                      {
                        "matchIndex": 0,
                        "numberdGroup": null,
                        "pattern": "((\\d{2})|(\\d{4}))-([0-1]\\d)-(([0-3]\\d)|(\\d))\\s((\\d)|([0-1]\\d)|(2[0-4])):[0-5][0-9]:[0-5][0-9]"
                      }
                    ]
                  }
                },
                "extractionType": "DateTime"
              }
            ],
            "inputs": [
              {
                "location": {
                  "fileSystemLocations": {
                    "linuxFileTypeLogPaths": null,
                    "windowsFileTypeLogPaths": [
                      "[concat('c:\\Windows\\Logs\\',parameters('customLogName'))]"
                    ]
                  }
                },
                "recordDelimiter": {
                  "regexDelimiter": {
                    "matchIndex": 0,
                    "numberdGroup": null,
                    "pattern": "(^.*((\\d{2})|(\\d{4}))-([0-1]\\d)-(([0-3]\\d)|(\\d))\\s((\\d)|([0-1]\\d)|(2[0-4])):[0-5][0-9]:[0-5][0-9].*$)"
                  }
                }
              }
            ]
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "type": "datasources",
          "name": "sampleLinuxPerfCollection1",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "kind": "LinuxPerformanceCollection",
          "properties": {
            "state": "Enabled"
          }
        },
        {
          "apiVersion": "2015-03-20",
          "name": "[concat(parameters('applicationDiagnosticsStorageAccountName'),parameters('workspaceName'))]",
          "type": "storageinsightconfigs",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "properties": {
            "containers": [
              "wad-iis-logfiles"
            ],
            "tables": [
              "WADWindowsEventLogsTable"
            ],
            "storageAccount": {
              "id": "[variables('diagnosticsStorageAccount')]",
              "key": "[listKeys(variables('diagnosticsStorageAccount'),'2015-06-15').key1]"
            }
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "location": "[parameters('location')]",
          "name": "[variables('Updates').Name]",
          "type": "Microsoft.OperationsManagement/solutions",
          "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.OperationsManagement/solutions/', variables('Updates').Name)]",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "properties": {
            "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          },
          "plan": {
            "name": "[variables('Updates').Name]",
            "publisher": "Microsoft",
            "product": "[Concat('OMSGallery/', variables('Updates').GalleryName)]",
            "promotionCode": ""
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "location": "[parameters('location')]",
          "name": "[variables('AntiMalware').Name]",
          "type": "Microsoft.OperationsManagement/solutions",
          "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.OperationsManagement/solutions/', variables('AntiMalware').Name)]",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "properties": {
            "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          },
          "plan": {
            "name": "[variables('AntiMalware').Name]",
            "publisher": "Microsoft",
            "product": "[Concat('OMSGallery/', variables('AntiMalware').GalleryName)]",
            "promotionCode": ""
          }
        },
        {
          "apiVersion": "2015-11-01-preview",
          "location": "[parameters('location')]",
          "name": "[variables('SQLAssessment').Name]",
          "type": "Microsoft.OperationsManagement/solutions",
          "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.OperationsManagement/solutions/', variables('SQLAssessment').Name)]",
          "dependsOn": [
            "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          ],
          "properties": {
            "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
          },
          "plan": {
            "name": "[variables('SQLAssessment').Name]",
            "publisher": "Microsoft",
            "product": "[Concat('OMSGallery/', variables('SQLAssessment').GalleryName)]",
            "promotionCode": ""
          }
        }
      ]
    }
  ],
  "outputs": {
    "workspaceName": {
      "type": "string",
      "value": "[parameters('workspaceName')]"
    },
    "provisioningState": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').provisioningState]"
    },
    "source": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').source]"
    },
    "customerId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').customerId]"
    },
    "sku": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').sku.name]"
    },
    "retentionInDays": {
      "type": "int",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').retentionInDays]"
    },
    "immediatePurgeDataOn30Days": {
      "type": "bool",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').features.immediatePurgeDataOn30Days]"
    },
    "portalUrl": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').portalUrl]"
    }
  }
}

部署示例模板Deploying the sample template

若要部署示例模板,请执行以下操作:To deploy the sample template:

  1. 将附加的示例保存到文件中,例如 azuredeploy.jsonSave the attached sample in a file, for example azuredeploy.json
  2. 编辑模板以便具有所需的配置Edit the template to have the configuration you want
  3. 使用 PowerShell 或命令行来部署模板Use PowerShell or the command line to deploy the template

PowerShellPowerShell

New-AzResourceGroupDeployment -Name <deployment-name> -ResourceGroupName <resource-group-name> -TemplateFile azuredeploy.json

命令行Command line

azure config mode arm
azure group deployment create <my-resource-group> <my-deployment-name> --TemplateFile azuredeploy.json

示例 资源管理器模板Example Resource Manager templates

Azure 快速入门模板库包含 Log Analytics 的多个模板,其中包括:The Azure quickstart template gallery includes several templates for Log Analytics, including:

后续步骤Next steps