Top / Microsoft Azure / Azure Log Analytics / Workspace

Azure Log Analytics Workspace

This page shows how to write Terraform and Azure Resource Manager for Log Analytics Workspace and write them securely.

terraform-logo

Review your .tf file for Azure best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

azurerm_log_analytics_workspace (Terraform)

The Workspace in Log Analytics can be configured in Terraform with the resource name azurerm_log_analytics_workspace. The following sections describe 9 examples of how to use the resource and its parameters.

Example Usage from GitHub

resources.tf#L1
resource "azurerm_log_analytics_workspace" "panel" {
  name                = "panel-workspace"
  location            = var.resource_group_location
  resource_group_name = var.resource_group_name
}
analytics.tf#L1
resource "azurerm_log_analytics_workspace" "example" {
  name                = var.workspace_name
  location            = var.location
  resource_group_name = var.resource_group_name
  sku                 = var.sku
  retention_in_days   = 30
log.tf#L1
resource "azurerm_log_analytics_workspace" "law" {
  name                = var.law_name
  location            = var.location
  resource_group_name = var.resource_group_name
  sku                 = "PerGB2018"
  retention_in_days   = 30
11.loganalytics.tf#L1
resource "azurerm_log_analytics_workspace" "loganal01" {
  name                = "loganal01"
  location            = azurerm_resource_group.dev-prolab-rg[0].location
  resource_group_name = azurerm_resource_group.dev-prolab-rg[0].name
  sku                 = "PerGB2018"
  retention_in_days   = 30
loganalytics.tf#L1
resource "azurerm_log_analytics_workspace" "workspace" {
  name                = var.loganalytics.name
  location            = var.location
  resource_group_name = azurerm_resource_group.loganalytics.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
main.tf#L1
resource "azurerm_log_analytics_workspace" "log_analytics_workspace" {
  name                = var.log_analytics_name
  location            = var.location
  resource_group_name = var.resource_group_name
  sku                 = var.log_analytics_sku
  retention_in_days   = var.retention_in_days
monitoring.tf#L2
resource "azurerm_log_analytics_workspace" "law_01" {
  name                = "aks-resources"
  location            = azurerm_resource_group.monitor.location
  resource_group_name = azurerm_resource_group.monitor.name
  sku                 = "Free"
}
logging.tf#L1
resource "azurerm_log_analytics_workspace" "cluster" {
  count               = var.enable_log_analytics ? 1 : 0
  name                = var.cluster_name
  location            = var.location
  resource_group_name = var.resource_group_name
  sku                 = "PerGB2018"
loganalytics.tf#L6
resource "azurerm_log_analytics_workspace" "loganalytics_sandbox" {
  name                = "sandbox-la-1"
  location            = azurerm_resource_group.loganalytics_rg.location
  resource_group_name = azurerm_resource_group.loganalytics_rg.name
  sku                 = "PerGB2018"
  retention_in_days   = 30

Review your Terraform file for Azure best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

>> from Terraform Registry

Explanation in Terraform Registry

Manages a Log Analytics (formally Operational Insights) Workspace.

>> from Terraform Registry

Microsoft.OperationalInsights/workspaces (Azure Resource Manager)

The workspaces in Microsoft.OperationalInsights can be configured in Azure Resource Manager with the resource name Microsoft.OperationalInsights/workspaces. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

application-gw-firewall-events.json
{
    "contentVersion": "1.0.0.0",
    "parameters": {
      "workbookDisplayName": {
        "type": "string",
workbooks.arm.template.statistics.detailed.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
workbooks.arm.template.statistics.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
application-gw-firewall-events.json
{
    "contentVersion": "1.0.0.0",
    "parameters": {
      "workbookDisplayName": {
        "type": "string",
workbook.json
{
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbookSourceId": {
            "type": "string",
application-gw-firewall-events.json
{
    "contentVersion": "1.0.0.0",
    "parameters": {
      "workbookDisplayName": {
        "type": "string",
application-gw-firewall-events.json
{
    "contentVersion": "1.0.0.0",
    "parameters": {
      "workbookDisplayName": {
        "type": "string",
template.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
AWS_User_Activities.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
workbooks.arm.template.rag.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",

Parameters

  • apiVersion required - string
  • eTag optional - string

    The ETag of the workspace.

  • location required - string

    The geo-location where the resource lives

  • name required - string

    The name of the workspace.

  • properties required
      • features optional
          • additionalProperties optional - object

            Unmatched properties from the message are deserialized this collection

          • clusterResourceId optional - string

            Dedicated LA cluster resourceId that is linked to the workspaces.

          • disableLocalAuth optional - boolean

            Disable Non-AAD based Auth.

          • enableDataExport optional - boolean

            Flag that indicate if data should be exported.

          • enableLogAccessUsingOnlyResourcePermissions optional - boolean

            Flag that indicate which permission to use - resource or workspace or both.

          • immediatePurgeDataOn30Days optional - boolean

            Flag that describes if we want to remove the data after 30 days.

      • forceCmkForQuery optional - boolean

        Indicates whether customer managed storage is mandatory for query management.

      • provisioningState optional - string

        The provisioning state of the workspace.

      • publicNetworkAccessForIngestion optional - string

        The network access type for accessing Log Analytics ingestion.

      • publicNetworkAccessForQuery optional - string

        The network access type for accessing Log Analytics query.

      • retentionInDays optional - integer

        The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.

      • sku optional
          • capacityReservationLevel optional - integer

            The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.

          • name required - string

            The name of the SKU.

      • workspaceCapping optional
          • dailyQuotaGb optional - number

            The workspace daily quota for ingestion.

  • tags optional - string

    Resource tags.

  • type required - string

>> from Azure Resource Manager Documentation

The Other Related Azure Log Analytics Resources

Frequently asked questions

What is Azure Log Analytics Workspace?

Azure Log Analytics Workspace is a resource for Log Analytics of Microsoft Azure. Settings can be wrote in Terraform.

Where can I find the example code for the Azure Log Analytics Workspace?

For Terraform, the kashw2/Fleet-of-the-Faithful-Knights, techbunny/hybrid-network-lab and aultt/Azure-Terraform-LabinaBox source code examples are useful. See the Terraform Example section for further details.

For Azure Resource Manager, the pkhabazi/sentineldevops, ObjectivityLtd/jmeter_simple_test and ObjectivityLtd/jmeter_simple_test source code examples are useful. See the Azure Resource Manager Example section for further details.

security-icon

Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.

Table of Contents