在 Azure Monitor 日志中添加或删除表和列

若要使用 Azure 门户创建自定义表，请执行以下操作：

1. 从“Log Analytics 工作区”菜单中，选择“Tables”。

2. 选择“创建”。

3. 输入名称，以及表的可选描述。 无需将 _CL 后缀添加到自定义表的名称。 门户会自动将后缀添加到指定的名称。

4. 在 “表计划”下，选择 “分析 ”（默认值）、 “基本”或 “辅助”/“湖”。

5. 从“数据收集规则”下拉列表中选择现有的数据收集规则，或选择“创建新的数据收集规则”并指定新数据收集规则的“订阅”、“资源组”和“名称”。

   

6. 选择一个数据收集终结点，然后选择“下一步”。 如果选择了已与 DCE 关联的 DCR，则此下拉列表不可用。

7. 选择“浏览文件”，找到具有新表的示例数据的 JSON 文件。 以下屏幕截图使用教程中脚本中的示例 JSON 文件：将数据发送到Azure Monitor日志。

   

   如果示例数据不包含 TimeGenerated 列，则会收到一条消息，指出门户会创建一个包含此列的转换。

8. 如果要在将日志数据引入到表中之前对其进行转换，请执行以下操作：

   1. 选择“转换编辑器”。

      使用转换编辑器可以为传入数据流创建转换。 该转换是一个对每条传入记录运行的 Kusto 查询语言 (KQL) 查询。 Azure Monitor 日志将查询结果存储在目标表中。

      

   2. 选择“运行”以查看结果。

      

9. 选择 “应用” 保存转换并查看新表的架构。 选择“下一步”。

   

10. 验证最终详细信息，然后选择“创建”以保存自定义日志。

    

1. 创建自定义表。 此示例使用Analytics命令创建包含az monitor log-analytics workspace table create计划的自定义表。 然后，它会创建一个 DCR，该 DCR 定义如何从数据源收集数据并将其发送到自定义表。

subscriptionId="aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
resourceGroupName="myResourceGroup"
workspaceName="myWorkspace"
tableName_CL="myTable_CL"

az account set --subscription "$subscriptionId"

az monitor log-analytics workspace table create \
  --resource-group "$resourceGroupName" \
  --workspace-name "$workspaceName" \
  --name "$tableName_CL" \
  --plan Analytics \
  --columns TimeGenerated=datetime RawData=string

若要使用 Auxiliary 计划创建自定义表，请使用 az rest 命令将请求发送到 PUT 日志管理 REST API。 请求正文指定表架构和表计划。

subscriptionId="aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
resourceGroupName="myResourceGroup"
workspaceName="myWorkspace"
tableName_CL="myTable_CL"
apiVersion="2025-07-01"
providers="Microsoft.OperationalInsights/workspaces/$workspaceName/tables/$tableName_CL"
resourceId="/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/$providers"
payloadFile="./my-table.json"

az account set --subscription $subscriptionId

az rest \
  --method put \
  --uri "$resourceId?api-version=$apiVersion" \
  --body @"$payloadFile"

{
  "properties": {
    "schema": {
      "name": "myTable_CL",
      "columns": [
        {
          "name": "TimeGenerated",
          "type": "dateTime"
        },
        {
          "name": "StringProperty",
          "type": "string"
        },
        {
          "name": "IntProperty",
          "type": "int"
        },
        {
          "name": "LongProperty",
          "type": "long"
        },
        {
          "name": "RealProperty",
          "type": "real"
        },
        {
          "name": "BooleanProperty",
          "type": "boolean"
        },
        {
          "name": "DateTimeProperty",
          "type": "dateTime"
        },
        {
          "name": "DynamicProperty",
          "type": "dynamic"
        }
      ]
    },
    "totalRetentionInDays": 365,
    "plan": "Auxiliary"
  }
}

2. 创建从数据源收集数据并将其发送到自定义表的数据收集规则。 此示例使用 az monitor 数据收集规则 命令组创建 DCR，该 DCR 从 Syslog 源收集数据，并将其发送到在上一步中创建的自定义表。

   subscriptionId="aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
   resourceGroupName="myResourceGroup"
   dataCollectionRuleName="myDataCollectionRule"
   ruleFile="./my-dcr.json"
   
   az account set --subscription "$subscriptionId"
   az extension add --name monitor-control-service
   
   az monitor data-collection rule create \
     --resource-group "$resourceGroupName" \
     --name "$dataCollectionRuleName" \
     --rule-file "$ruleFile"
   

   注释

   Azure CLI命令使用当前 CLI 上下文中的Azure 资源管理器终结点，因此无需在命令语法中指定 management.chinacloudapi.cn。

   
   
   展开以查看 my-dcr.json 文件。

   {
     "location": "chinanorth2",
     "kind": "Direct",
     "properties": {
       "streamDeclarations": {
         "myTable": {
           "columns": [
             {
               "name": "TimeGenerated",
               "type": "dateTime"
             },
             {
               "name": "StringProperty",
               "type": "string"
             },
             {
               "name": "IntProperty",
               "type": "int"
             },
             {
               "name": "LongProperty",
               "type": "long"
             },
             {
               "name": "RealProperty",
               "type": "real"
             },
             {
               "name": "BooleanProperty",
               "type": "boolean"
             },
             {
               "name": "DateTimeProperty",
               "type": "dateTime"
             },
             {
               "name": "DynamicProperty",
               "type": "dynamic"
             }
           ]
         }
       },
       "destinations": {
         "logAnalytics": [
           {
             "workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace",
             "name": "myWorkspace"
           }
         ]
       },
       "dataFlows": [
         {
           "streams": [
             "myTable"
           ],
           "transformKql": "source",
           "destinations": [
             "myWorkspace"
           ],
           "outputStream": "Custom-myTable_CL"
         }
       ]
     }
   }
   

1. 创建表。 此示例在请求有效负载中创建一个自定义表 "plan": "Auxiliary" 。

PUT https://management.chinacloudapi.cn/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName_CL}?api-version={apiVersion}
Authorization: Bearer {token}
Content-Type: application/json

{
  "properties": {
    "schema": {
      "name": "{tableName_CL}",
      "columns": [
        {"name": "TimeGenerated",
          "type": "dateTime"},
        {"name": "StringProperty",
          "type": "string"},
        {"name": "IntProperty",
          "type": "int"},
        {"name": "LongProperty",
          "type": "long"},
        {"name": "RealProperty",
          "type": "real"},
        {"name": "BooleanProperty",
          "type": "boolean"},
        {"name": "DateTimeProperty",
          "type": "dateTime"},
        {"name": "DynamicProperty",
          "type": "dynamic"}
      ]
    },
    "totalRetentionInDays": 365,
    "plan": "Auxiliary"
  }
}

2. 创建数据收集规则。 这是一个将 kind 设置为 Direct 的示例。 此 DCR 类型不需要数据收集终结点（DCE），因为它会创建自己的 logsIngestion 终结点。

   • myWorkspace 是 Log Analytics 工作区的名称。
   • myTable_CL 是表的名称。
   • columns 包括创建表时定义的相同列。

   PUT https://management.chinacloudapi.cn/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dataCollectionRuleName}?api-version={apiVersion}
   Authorization: Bearer {token}
   Content-Type: application/json
   
   {
     "location": "chinanorth2",
     "kind": "Direct",
     "properties": {
       "streamDeclarations": {
         "myTable": {
           "columns": [
             {
               "name": "TimeGenerated",
               "type": "dateTime"
             },
             {
               "name": "StringProperty",
               "type": "string"
             },
             {
               "name": "IntProperty",
               "type": "int"
             },
             {
               "name": "LongProperty",
               "type": "long"
             },
             {
               "name": "RealProperty",
               "type": "real"
             },
             {
               "name": "BooleanProperty",
               "type": "boolean"
             },
             {
               "name": "DateTimeProperty",
               "type": "dateTime"
             },
             {
               "name": "DynamicProperty",
               "type": "dynamic"
             }
           ]
         }
       },
       "destinations": {
         "logAnalytics": [
           {
             "workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace",
             "name": "myWorkspace"
           }
         ]
       },
       "dataFlows": [
         {
           "streams": [
             "myTable"
           ],
           "transformKql": "source",
           "destinations": [
             "myWorkspace"
           ],
           "outputStream": "Custom-myTable_CL"
         }
       ]
     }
   }
   

1. 使用 New-AzOperationalInsightsTable 命令或 Invoke-AzRestMethod 创建该表。 此示例使用 New-AzOperationalInsightsTable 命令创建包含 Analytics 计划的自定义表。

$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
$resourceGroupName = "myResourceGroup"
$workspaceName = "myWorkspace"
$tableName_CL = "myTable_CL"
$payloadFile = ".\my-table.json"

Set-AzContext -Subscription $subscriptionId

$tableParams = @{
    ResourceGroupName = $resourceGroupName
    WorkspaceName = $workspaceName
    TableName = $tableName_CL
    RetentionInDays = 31
    TotalRetentionInDays = 365
    Plan = 'Analytics'
    Description = 'My custom table created with PowerShell'
    Payload = Get-Content -Raw -Path $payloadFile
    Column = @{'TimeGenerated'='DateTime'; 'RawData'='String'}
}

New-AzOperationalInsightsTable @tableParams

若要使用 Auxiliary 计划创建自定义表，请使用 Invoke-AzRestMethod 命令将请求发送到 PUT 日志管理 REST API。 请求正文指定表架构和表计划。

$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
$resourceGroupName = "myResourceGroup"
$workspaceName = "myWorkspace"
$tableName_CL = "myTable_CL"
$apiVersion = "2025-07-01"
$providers = "Microsoft.OperationalInsights/workspaces/$workspaceName/tables/$tableName_CL"
$resourceId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/$providers"
$payloadFile = ".\my-table.json"

Set-AzContext -Subscription $subscriptionId

$restParams = @{
    Method  = "PUT"
    Path    = "$resourceId?api-version=$apiVersion"
    Payload = Get-Content -Raw -Path $payloadFile
}

Invoke-AzRestMethod @restParams

{
  "properties": {
    "schema": {
      "name": "myTable_CL",
      "columns": [
        {
          "name": "TimeGenerated",
          "type": "dateTime"
        },
        {
          "name": "StringProperty",
          "type": "string"
        },
        {
          "name": "IntProperty",
          "type": "int"
        },
        {
          "name": "LongProperty",
          "type": "long"
        },
        {
          "name": "RealProperty",
          "type": "real"
        },
        {
          "name": "BooleanProperty",
          "type": "boolean"
        },
        {
          "name": "DateTimeProperty",
          "type": "dateTime"
        },
        {
          "name": "DynamicProperty",
          "type": "dynamic"
        }
      ]
    },
    "totalRetentionInDays": 365,
    "plan": "Auxiliary"
  }
}

2. 创建从数据源收集数据并将其发送到自定义表的数据收集规则。 此 PowerShell 示例使用 New-AzDataCollectionRule cmdlet 创建从 Syslog 源收集数据并将其发送到在上一步中创建的自定义表的 DCR。

   $subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
   $resourceGroupName = "myResourceGroup"
   $dataCollectionRuleName = "myDataCollectionRule"
   $jsonFilePath = ".\my-dcr.json"
   
   Select-AzSubscription -SubscriptionId $subscriptionId
   
   $dataCollectionRuleParams = @{
       Name              = $dataCollectionRuleName
       ResourceGroupName = $resourceGroupName
       JsonFilePath      = $jsonFilePath
   }
   
   New-AzDataCollectionRule @dataCollectionRuleParams
   

   注释

   Azure PowerShell cmdlet 使用当前 Az 上下文中的Azure 资源管理器终结点，因此无需在 cmdlet 语法中指定management.chinacloudapi.cn。

   
   
   展开以查看 my-dcr.json 文件。

   {
     "location": "chinanorth2",
     "kind": "Direct",
     "properties": {
       "streamDeclarations": {
         "myTable": {
           "columns": [
             {
               "name": "TimeGenerated",
               "type": "dateTime"
             },
             {
               "name": "StringProperty",
               "type": "string"
             },
             {
               "name": "IntProperty",
               "type": "int"
             },
             {
               "name": "LongProperty",
               "type": "long"
             },
             {
               "name": "RealProperty",
               "type": "real"
             },
             {
               "name": "BooleanProperty",
               "type": "boolean"
             },
             {
               "name": "DateTimeProperty",
               "type": "dateTime"
             },
             {
               "name": "DynamicProperty",
               "type": "dynamic"
             }
           ]
         }
       },
       "destinations": {
         "logAnalytics": [
           {
             "workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace",
             "name": "myWorkspace"
           }
         ]
       },
       "dataFlows": [
         {
           "streams": [
             "myTable"
           ],
           "transformKql": "source",
           "destinations": [
             "myWorkspace"
           ],
           "outputStream": "Custom-myTable_CL"
         }
       ]
     }
   }
   

1. 使用以下示例Azure 资源管理器模板（ARM 模板）创建表。 此 JSON 示例使用 Microsoft.OperationalInsights 工作区/表 资源类型来创建具有自定义架构的 辅助 / Lake 表。

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "string",
      "defaultValue": "myWorkspace"
    },
    "tableName_CL": {
      "type": "string",
      "defaultValue": "myTable_CL"
    }
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2025-07-01",
      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('tableName_CL'))]",
      "properties": {
        "schema": {
          "name": "[parameters('tableName_CL')]",
          "columns": [
            {
              "name": "TimeGenerated",
              "type": "dateTime"
            },
            {
              "name": "StringProperty",
              "type": "string"
            },
            {
              "name": "IntProperty",
              "type": "int"
            },
            {
              "name": "LongProperty",
              "type": "long"
            },
            {
              "name": "RealProperty",
              "type": "real"
            },
            {
              "name": "BooleanProperty",
              "type": "boolean"
            },
            {
              "name": "DateTimeProperty",
              "type": "dateTime"
            },
            {
              "name": "DynamicProperty",
              "type": "dynamic"
            }
          ]
        },
        "totalRetentionInDays": 365,
        "plan": "Auxiliary"
      }
    }
  ]
}

2. 创建从数据源收集数据并将其发送到自定义表的数据收集规则。 以下 ARM 模板示例使用Microsoft。Insights dataCollectionRules 资源类型。

   {
     "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
     "contentVersion": "1.0.0.0",
     "parameters": {
       "dataCollectionRuleName": {
         "type": "string",
         "defaultValue": "myDataCollectionRule",
         "metadata": {
           "description": "Specifies the name of the data collection rule to create."
         }
       },
       "location": {
         "type": "string",
         "defaultValue": "chinanorth2",
         "metadata": {
           "description": "Specifies the region in which to create the data collection rule. It must be the same region as the destination Log Analytics workspace."
         }
       },
       "workspaceResourceId": {
         "type": "string",
         "defaultValue": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace",
         "metadata": {
           "description": "The Azure resource ID of the Log Analytics workspace in which you created a custom table with the Auxiliary plan."
         }
       }
     },
     "resources": [
       {
         "type": "Microsoft.Insights/dataCollectionRules",
         "name": "[parameters('dataCollectionRuleName')]",
         "location": "[parameters('location')]",
         "apiVersion": "2025-07-01",
         "kind": "Direct",
         "properties": {
           "streamDeclarations": {
             "myTable": {
               "columns": [
                 {
                   "name": "TimeGenerated",
                   "type": "dateTime"
                 },
                 {
                   "name": "StringProperty",
                   "type": "string"
                 },
                 {
                   "name": "IntProperty",
                   "type": "int"
                 },
                 {
                   "name": "LongProperty",
                   "type": "long"
                 },
                 {
                   "name": "RealProperty",
                   "type": "real"
                 },
                 {
                   "name": "BooleanProperty",
                   "type": "boolean"
                 },
                 {
                   "name": "DateTimeProperty",
                   "type": "dateTime"
                 },
                 {
                   "name": "DynamicProperty",
                   "type": "dynamic"
                 }
               ]
             }
           },
           "destinations": {
             "logAnalytics": [
               {
                 "workspaceResourceId": "[parameters('workspaceResourceId')]",
                 "name": "myWorkspace"
               }
             ]
           },
           "dataFlows": [
             {
               "streams": [
                 "myTable"
               ],
               "transformKql": "source",
               "destinations": [
                 "myWorkspace"
               ],
               "outputStream": "Custom-myTable_CL"
             }
           ]
         }
       }
     ],
     "outputs": {
       "dataCollectionRuleId": {
         "type": "string",
         "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
       }
     }
   }
   

1. 使用以下 Bicep 示例创建表。 此示例使用Microsoft。OperationalInsights 工作区/表资源类型，用于创建具有自定义架构的辅助表。

   该示例列出了除 之外 guid的所有受支持的列数据类型。 Log Analytics将 GUID 存储并查询为string类型，即使将列定义为guid类型。

param workspaceName string = 'myWorkspace'
param tableName_CL string = 'myTable_CL'

resource workspace 'Microsoft.OperationalInsights/workspaces@2025-07-01' existing = {
  name: workspaceName
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2025-07-01' = {
  parent: workspace
  name: tableName_CL
  properties: {
    schema: {
      name: tableName_CL
      columns: [
        {
          name: 'TimeGenerated'
          type: 'dateTime'
        }
        {
          name: 'StringProperty'
          type: 'string'
        }
        {
          name: 'IntProperty'
          type: 'int'
        }
        {
          name: 'LongProperty'
          type: 'long'
        }
        {
          name: 'RealProperty'
          type: 'real'
        }
        {
          name: 'BooleanProperty'
          type: 'boolean'
        }
        {
          name: 'DateTimeProperty'
          type: 'dateTime'
        }
        {
          name: 'DynamicProperty'
          type: 'dynamic'
        }
      ]
    }
    totalRetentionInDays: 365
    plan: 'Auxiliary'
  }
}

2. 使用以下 Bicep 示例创建 DCR，该示例中使用了 Microsoft.Insights dataCollectionRules 资源类型。

   @description('Specifies the name of the data collection rule to create.')
   param dataCollectionRuleName string = 'myDataCollectionRule'
   
   @description('Specifies the region in which to create the data collection rule. It must be the same region as the destination Log Analytics workspace.')
   param location string = 'chinanorth2'
   
   @description('The Azure resource ID of the Log Analytics workspace in which you created a custom table with the Auxiliary plan.')
   param workspaceResourceId string = '/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace'
   
   resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2025-07-01' = {
     name: dataCollectionRuleName
     location: location
     kind: 'Direct'
     properties: {
       streamDeclarations: {
         'myTable': {
           columns: [
             {
               name: 'TimeGenerated'
               type: 'dateTime'
             }
             {
               name: 'StringProperty'
               type: 'string'
             }
             {
               name: 'IntProperty'
               type: 'int'
             }
             {
               name: 'LongProperty'
               type: 'long'
             }
             {
               name: 'RealProperty'
               type: 'real'
             }
             {
               name: 'BooleanProperty'
               type: 'boolean'
             }
             {
               name: 'DateTimeProperty'
               type: 'dateTime'
             }
             {
               name: 'DynamicProperty'
               type: 'dynamic'
             }
           ]
         }
       }
       destinations: {
         logAnalytics: [
           {
             workspaceResourceId: workspaceResourceId
             name: 'myWorkspace'
           }
         ]
       }
       dataFlows: [
         {
           streams: [
             'myTable'
           ]
           transformKql: 'source'
           destinations: [
             'myWorkspace'
           ]
           outputStream: 'Custom-myTable_CL'
         }
       ]
     }
   }
   
   output dataCollectionRuleId string = dataCollectionRule.id
   

若要从 Azure 门户中删除表，请执行以下操作：

1. 在“Log Analytics 工作区”菜单中，选择“表”。

2. 按名称搜索要删除的表，或在“类型”字段中选择“搜索结果”。

   

3. 选择要删除的表，点击表右侧的省略号按钮 (...)，选择删除，并通过输入yes确认删除。

   

subscriptionId="aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
resourceGroupName="myResourceGroup"
workspaceName="myWorkspace"
tableName_CL="myTable_CL"

az account set --subscription "$subscriptionId"

az monitor log-analytics workspace table delete \
  --resource-group "$resourceGroupName" \
  --workspace-name "$workspaceName" \
  --name "$tableName_CL" \
  --yes

DELETE https://management.chinacloudapi.cn/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName_CL}?api-version={apiVersion}
Authorization: Bearer {token}

专用Azure PowerShell cmdlet 不适用于此操作。 使用 Invoke-AzRestMethod 直接调用 REST API。

$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
$resourceGroupName = "myResourceGroup"
$workspaceName = "myWorkspace"
$tableName_CL = "myTable_CL"
$apiVersion = "2025-07-01"
$providers = "Microsoft.OperationalInsights/workspaces/$workspaceName/tables/$tableName_CL"
$resourceId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/$providers"

Set-AzContext -Subscription $subscriptionId

$restParams = @{
    Method = "DELETE"
    Path   = "$resourceId?api-version=$apiVersion"
}

Invoke-AzRestMethod @restParams

若要将自定义列添加到 Log Analytics 工作区中的表，或者要删除列，请执行以下操作：

1. 从“Log Analytics 工作区”菜单中，选择“Tables”。

2. 选择要编辑的表右侧的省略号 (...)，然后选择“编辑架构”。

   此操作将打开 “架构编辑器” 屏幕。

3. 请向下滚动到“模式编辑器”屏幕的“自定义列”部分。

   

4. 若要添加新列，请执行以下操作：

   1. 选择添加列。
   2. 设置列名和说明（可选），然后从“类型”下拉列表中选择预期的值类型。
   3. 选择“保存”，以保存新列。

5. 若要删除列，请选择要删除的列左侧的“删除”图标。

要添加自定义列：

subscriptionId="aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
resourceGroupName="myResourceGroup"
workspaceName="myWorkspace"
tableName="Heartbeat"

az account set --subscription "$subscriptionId"

az monitor log-analytics workspace table update \
  --resource-group "$resourceGroupName" \
  --workspace-name "$workspaceName" \
  --name "$tableName" \
  --columns Custom1_CF=string

若要删除自定义列，请使用 REST API 或 PowerShell 方法。 CLI update 命令添加列，但不支持删除列。

若要添加自定义列，请发送包含更新后架构定义的 PUT 请求。 将新列包含在 columns 数组中。 请求返回更新的表属性。

若要删除自定义列，请发送相同的 PUT 请求，但省略数组中的 columns 列。 若要删除所有自定义列，请发送一个空 columns 数组。

PUT https://management.chinacloudapi.cn/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version={apiVersion}
Authorization: Bearer {token}
Content-Type: application/json

{
  "properties": {
    "schema": {
      "name": "{tableName}",
      "columns": [
        {"name": "{columnName}",
          "type": "string",
          "description": "Custom column description"}
      ]
    }
  }
}

专用Azure PowerShell cmdlet 不适用于此操作。 使用 Invoke-AzRestMethod 直接调用 REST API。

添加自定义列

$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
$resourceGroupName = "myResourceGroup"
$workspaceName = "myWorkspace"
$tableName = "Heartbeat"
$apiVersion = "2025-07-01"
$providers = "Microsoft.OperationalInsights/workspaces/$workspaceName/tables/$tableName"
$resourceId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/$providers"
$payloadFile = ".\add-column.json"

Set-AzContext -Subscription $subscriptionId

$restParams = @{
    Method  = "PUT"
    Path    = "$resourceId?api-version=$apiVersion"
    Payload = Get-Content -Raw -Path $payloadFile
}

Invoke-AzRestMethod @restParams

{
  "properties": {
    "schema": {
      "name": "Heartbeat",
      "columns": [
        {
          "name": "Custom1_CF",
          "type": "string",
          "description": "First custom column"
        }
      ]
    }
  }
}

调用 PUT 返回更新的表属性，其中包括新添加的列。

替换自定义列

若要删除列并添加另一列 PUT ，请发送仅包含要保留的列的请求。 以下示例将 Custom1_CF 替换为 Custom2_CF：

{
  "properties": {
    "schema": {
      "name": "Heartbeat",
      "columns": [
        {
          "name": "Custom2_CF",
          "type": "datetime",
          "description": "Replacement custom column"
        }
      ]
    }
  }
}

删除所有自定义列

若要从表中删除所有自定义列，请发送 PUT 包含空 columns 数组的请求：

{
  "properties": {
    "schema": {
      "name": "Heartbeat",
      "columns": []
    }
  }
}