Set up a table with the Auxiliary plan in your Log Analytics workspace

The Auxiliary table plan lets you ingest and retain data in your Log Analytics workspace at a low cost.

Here's a video that explains some of the uses and benefits of the Auxiliary table plan:

Azure Monitor Logs currently supports the Auxiliary table plan on data collection rule (DCR)-based custom tables to which you send data you collect using Azure Monitor Agent or the Logs ingestion API.

This article explains how to create a new custom table with the Auxiliary plan in your Log Analytics workspace and set up a data collection rule that sends data to this table. For more information about Auxiliary plan concepts, see Azure Monitor Logs table plans.

Prerequisites

To create a custom table and collect log data, you need:

• A Log Analytics workspace where you have at least contributor rights.
• A data collection endpoint (DCE).
• Setting up a table with the Auxiliary plan is only supported on new tables. After you create a table with an Auxiliary plan, you can't switch the table's plan.

Create a custom table with the Auxiliary plan

To create a custom table, call the Tables - Create API by using this command:

PUT https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.OperationalInsights/workspaces/{workspace_name}/tables/{table name_CL}?api-version=2023-01-01-preview

Provide this payload as the body of your request. Update the table name and adjust the columns based on your table schema. This sample lists all the supported column data types.

 {
    "properties": {
        "schema": {
            "name": "table_name_CL",
            "columns": [
                {"name": "TimeGenerated",
                 "type": "datetime"},
                {"name": "StringProperty",
                 "type": "string"},
                {"name": "IntProperty",
                 "type": "int"},
                {"name": "LongProperty",
                 "type": "long"},
                {"name": "RealProperty",
                 "type": "real"},
                {"name": "BooleanProperty",
                 "type": "boolean"},
                {"name": "GuidProperty",
                 "type": "guid"},
                {"name": "DateTimeProperty",
                 "type": "datetime"}
            ]
        },
        "totalRetentionInDays": 365,
        "plan": "Auxiliary"
    }
}

Send data to a table with the Auxiliary plan

There are currently two ways to ingest data to a custom table with the Auxiliary plan.

• Use the Azure Monitor Agent (AMA)
• Use the logs ingestion API

Use the AMA

If you use this method, your custom table must only have two columns - TimeGenerated (type datetime) and RawData (of type string). The data collection rule sends the entirety of each log entry you collect to the RawData column, and Azure Monitor Logs automatically populates the TimeGenerated column with the time the log is ingested.

For more information on how to use the AMA, see the following articles:

• Collect logs from a text file with Azure Monitor Agent
• Collect logs from a JSON file with Azure Monitor Agent.

Use the logs ingestion API

This method closely follows the steps described in Tutorial: Send data to Azure Monitor using Logs ingestion API.

1. Create a custom table with the Auxiliary plan as described in this article.
2. Create a Microsoft Entra application.
3. Create a data collection rule. Here's a sample ARM template for kind: Direct. This type of DCR doesn't require a DCE since it includes a logsIngestion endpoint.

   • myworkspace is the name of your Log Analytics workspace.

   • tablename_CL is the name of your table.

   • columns includes the same columns you set in the creation of the table.

     {
         "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
         "contentVersion": "1.0.0.0",
         "parameters": {
             "dataCollectionRuleName": {
                 "type": "string",
                 "metadata": {"description": "Specifies the name of the data collection rule to create."}
             },
             "___location": {
                 "type": "string",
                 "metadata": {"description": "Specifies the region in which to create the data collection rule. The must be the same region as the destination Log Analytics workspace."}
             },
             "workspaceResourceId": {
                 "type": "string",
                 "metadata": {"description": "The Azure resource ID of the Log Analytics workspace in which you created a custom table with the Auxiliary plan."}
             }
         },
         "resources": [
             {
                 "type": "Microsoft.Insights/dataCollectionRules",
                 "name": "[parameters('dataCollectionRuleName')]",
                 "___location": "[parameters('___location')]",
                 "apiVersion": "2023-03-11",
                 "kind": "Direct",
                 "properties": {
                     "streamDeclarations": {
                         "Custom-tablename_CL": {
                             "columns": [
                                 {"name": "TimeGenerated",
                                  "type": "datetime"},
                                 {"name": "StringProperty",
                                  "type": "string"},
                                 {"name": "IntProperty",
                                  "type": "int"},
                                 {"name": "LongProperty",
                                  "type": "long"},
                                 {"name": "RealProperty",
                                  "type": "real"},
                                 {"name": "BooleanProperty",
                                  "type": "boolean"},
                                 {"name": "GuidProperty",
                                  "type": "guid"},
                                 {"name": "DateTimeProperty",
                                  "type": "datetime"}]
                                     }
                                 },
                     "destinations": {
                         "logAnalytics": [
                             {"workspaceResourceId": "[parameters('workspaceResourceId')]",
                              "name": "myworkspace"}]
                     },
                     "dataFlows": [
                         {
                             "streams": ["Custom-table_name"],
                             "transformKql": "source",
                             "destinations": ["myworkspace"],
                             "outputStream": "Custom-tablename-CL"
                         }]
                 }
             }],
         "outputs": {
             "dataCollectionRuleId": {
                 "type": "string",
                 "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
             }
         }
     }
     

4. Grant your application permission to use your DCR.
5. Send data using sample code.

Related content

• Azure Monitor Logs table plans
• Collecting logs with the Log Ingestion API
• Data collection rules