Note

Access to this page requires authorization. You can try signing in or .

Access to this page requires authorization. You can try .

Microsoft.Insights dataCollectionRules

Bicep resource definition

The dataCollectionRules resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/dataCollectionRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Insights/dataCollectionRules@2024-03-11' = {
 identity: {
 type: 'string'
 userAssignedIdentities: {
 {customized property}: {}
 }
 }
 kind: 'string'
 location: 'string'
 name: 'string'
 properties: {
 agentSettings: {
 logs: [
 {
 name: 'string'
 value: 'string'
 }
 ]
 }
 dataCollectionEndpointId: 'string'
 dataFlows: [
 {
 builtInTransform: 'string'
 captureOverflow: bool
 destinations: [
 'string'
 ]
 outputStream: 'string'
 streams: [
 'string'
 ]
 transformKql: 'string'
 }
 ]
 dataSources: {
 dataImports: {
 eventHub: {
 consumerGroup: 'string'
 name: 'string'
 stream: 'string'
 }
 }
 etwProviders: [
 {
 eventIds: [
 'string'
 ]
 keyword: 'string'
 logLevel: 'string'
 name: 'string'
 provider: 'string'
 providerType: 'string'
 streams: [
 'string'
 ]
 }
 ]
 extensions: [
 {
 extensionName: 'string'
 extensionSettings: any(...)
 inputDataSources: [
 'string'
 ]
 name: 'string'
 streams: [
 'string'
 ]
 }
 ]
 iisLogs: [
 {
 logDirectories: [
 'string'
 ]
 name: 'string'
 streams: [
 'string'
 ]
 transformKql: 'string'
 }
 ]
 logFiles: [
 {
 filePatterns: [
 'string'
 ]
 format: 'string'
 name: 'string'
 settings: {
 text: {
 recordStartTimestampFormat: 'string'
 }
 }
 streams: [
 'string'
 ]
 transformKql: 'string'
 }
 ]
 otelLogs: [
 {
 enrichWithReference: 'string'
 enrichWithResourceAttributes: [
 'string'
 ]
 name: 'string'
 replaceResourceIdWithReference: bool
 resourceAttributeRouting: {
 attributeName: 'string'
 attributeValue: 'string'
 }
 streams: [
 'string'
 ]
 }
 ]
 otelMetrics: [
 {
 enrichWithReference: 'string'
 enrichWithResourceAttributes: [
 'string'
 ]
 name: 'string'
 resourceAttributeRouting: {
 attributeName: 'string'
 attributeValue: 'string'
 }
 streams: [
 'string'
 ]
 }
 ]
 otelTraces: [
 {
 enrichWithReference: 'string'
 enrichWithResourceAttributes: [
 'string'
 ]
 name: 'string'
 replaceResourceIdWithReference: bool
 resourceAttributeRouting: {
 attributeName: 'string'
 attributeValue: 'string'
 }
 streams: [
 'string'
 ]
 }
 ]
 performanceCounters: [
 {
 counterSpecifiers: [
 'string'
 ]
 name: 'string'
 samplingFrequencyInSeconds: int
 streams: [
 'string'
 ]
 transformKql: 'string'
 }
 ]
 performanceCountersOTel: [
 {
 counterSpecifiers: [
 'string'
 ]
 name: 'string'
 samplingFrequencyInSeconds: int
 streams: [
 'string'
 ]
 }
 ]
 platformTelemetry: [
 {
 name: 'string'
 streams: [
 'string'
 ]
 }
 ]
 prometheusForwarder: [
 {
 customVMScrapeConfig: [
 any(...)
 ]
 labelIncludeFilter: {
 {customized property}: 'string'
 }
 name: 'string'
 streams: [
 'string'
 ]
 }
 ]
 syslog: [
 {
 facilityNames: [
 'string'
 ]
 logLevels: [
 'string'
 ]
 name: 'string'
 streams: [
 'string'
 ]
 transformKql: 'string'
 }
 ]
 windowsEventLogs: [
 {
 name: 'string'
 streams: [
 'string'
 ]
 transformKql: 'string'
 xPathQueries: [
 'string'
 ]
 }
 ]
 windowsFirewallLogs: [
 {
 name: 'string'
 profileFilter: [
 'string'
 ]
 streams: [
 'string'
 ]
 }
 ]
 }
 description: 'string'
 destinations: {
 azureDataExplorer: [
 {
 databaseName: 'string'
 name: 'string'
 resourceId: 'string'
 }
 ]
 azureMonitorMetrics: {
 name: 'string'
 }
 eventHubs: [
 {
 eventHubResourceId: 'string'
 name: 'string'
 }
 ]
 eventHubsDirect: [
 {
 eventHubResourceId: 'string'
 name: 'string'
 }
 ]
 logAnalytics: [
 {
 name: 'string'
 workspaceResourceId: 'string'
 }
 ]
 microsoftFabric: [
 {
 artifactId: 'string'
 databaseName: 'string'
 ingestionUri: 'string'
 name: 'string'
 tenantId: 'string'
 }
 ]
 monitoringAccounts: [
 {
 accountResourceId: 'string'
 name: 'string'
 }
 ]
 storageAccounts: [
 {
 containerName: 'string'
 name: 'string'
 storageAccountResourceId: 'string'
 }
 ]
 storageBlobsDirect: [
 {
 containerName: 'string'
 name: 'string'
 storageAccountResourceId: 'string'
 }
 ]
 storageTablesDirect: [
 {
 name: 'string'
 storageAccountResourceId: 'string'
 tableName: 'string'
 }
 ]
 }
 directDataSources: {
 otelLogs: [
 {
 enrichWithReference: 'string'
 enrichWithResourceAttributes: [
 'string'
 ]
 name: 'string'
 replaceResourceIdWithReference: bool
 streams: [
 'string'
 ]
 }
 ]
 otelMetrics: [
 {
 enrichWithReference: 'string'
 enrichWithResourceAttributes: [
 'string'
 ]
 name: 'string'
 streams: [
 'string'
 ]
 }
 ]
 otelTraces: [
 {
 enrichWithReference: 'string'
 enrichWithResourceAttributes: [
 'string'
 ]
 name: 'string'
 replaceResourceIdWithReference: bool
 streams: [
 'string'
 ]
 }
 ]
 }
 references: {
 applicationInsights: [
 {
 name: 'string'
 resourceId: 'string'
 }
 ]
 enrichmentData: {
 storageBlobs: [
 {
 blobUrl: 'string'
 lookupType: 'string'
 name: 'string'
 resourceId: 'string'
 }
 ]
 }
 }
 streamDeclarations: {
 {customized property}: {
 columns: [
 {
 name: 'string'
 type: 'string'
 }
 ]
 }
 }
 }
 sku: {
 capacity: int
 family: 'string'
 name: 'string'
 size: 'string'
 tier: 'string'
 }
 tags: {
 {customized property}: 'string'
 }
}

Property Values

Microsoft.Insights/dataCollectionRules

Name	Description	Value
identity	Managed service identity of the resource.	DataCollectionRuleResourceIdentity
kind	The kind of the resource.	'Linux' 'Windows'
location	The geo-location where the resource lives	string (required)
name	The resource name	string (required)
properties	DataCollectionRuleResourceProperties
sku	The SKU of the resource.	DataCollectionRuleResourceSku
tags	Resource tags	Dictionary of tag names and values. See Tags in templates

AdxDestination

Name	Description	Value
databaseName	The name of the database to which data will be ingested.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
resourceId	The ARM resource id of the Adx resource.	string

AgentSetting

Name	Description	Value
name	The name of the setting. Must be part of the list of supported settings	'MaxDiskQuotaInMB' 'Tags' 'UseTimeReceivedForForwardedEvents'
value	The value of the setting	string

ApplicationInsights

Name	Description	Value
name	The name of the reference used as an alias when referencing this application insights in Otel data sources	string (required)
resourceId	Id of the application insights resource	string (required)

ColumnDefinition

Name	Description	Value
name	The name of the column.	string
type	The type of the column data.	'boolean' 'datetime' 'dynamic' 'int' 'long' 'real' 'string'

DataCollectionRuleAgentSettings

Name	Description	Value
logs	All the settings that are applicable to the logs agent (AMA)	AgentSetting[]

DataCollectionRuleDataSources

Name	Description	Value
dataImports	Specifications of pull based data sources	DataSourcesSpecDataImports
etwProviders	The list of ETW providers data source configurations.	EtwProviderDataSource[]
extensions	The list of Azure VM extension data source configurations.	ExtensionDataSource[]
iisLogs	The list of IIS logs source configurations.	IisLogsDataSource[]
logFiles	The list of Log files source configurations.	LogFilesDataSource[]
otelLogs	The list of Otel Logs data source configurations.	OtelLogsDataSource[]
otelMetrics	The list of OTel metrics data source configurations.	OtelMetricsDataSource[]
otelTraces	The list of Otel traces data source configurations.	OtelTracesDataSource[]
performanceCounters	The list of performance counter data source configurations.	PerfCounterDataSource[]
performanceCountersOTel	The list of Open Telemetry performance counter data source configurations.	PerformanceCountersOTelDataSource[]
platformTelemetry	The list of platform telemetry configurations	PlatformTelemetryDataSource[]
prometheusForwarder	The list of Prometheus forwarder data source configurations.	PrometheusForwarderDataSource[]
syslog	The list of Syslog data source configurations.	SyslogDataSource[]
windowsEventLogs	The list of Windows Event Log data source configurations.	WindowsEventLogDataSource[]
windowsFirewallLogs	The list of Windows Firewall logs source configurations.	WindowsFirewallLogsDataSource[]

DataCollectionRuleDestinations

Name	Description	Value
azureDataExplorer	List of Azure Data Explorer destinations.	AdxDestination[]
azureMonitorMetrics	Azure Monitor Metrics destination.	DestinationsSpecAzureMonitorMetrics
eventHubs	List of Event Hubs destinations.	EventHubDestination[]
eventHubsDirect	List of Event Hubs Direct destinations.	EventHubDirectDestination[]
logAnalytics	List of Log Analytics destinations.	LogAnalyticsDestination[]
microsoftFabric	List of Microsoft Fabric destinations.	MicrosoftFabricDestination[]
monitoringAccounts	List of monitoring account destinations.	MonitoringAccountDestination[]
storageAccounts	List of storage accounts destinations.	StorageBlobDestination[]
storageBlobsDirect	List of Storage Blob Direct destinations. To be used only for sending data directly to store from the agent.	StorageBlobDestination[]
storageTablesDirect	List of Storage Table Direct destinations.	StorageTableDestination[]

DataCollectionRuleDirectDataSources

Name	Description	Value
otelLogs	The list of OTel logs data source configurations.	OtelLogsDirectDataSource[]
otelMetrics	The list of OTel metrics data source configurations.	OtelMetricsDirectDataSource[]
otelTraces	The list of OTel traces data source configurations.	OtelTracesDirectDataSource[]

DataCollectionRuleReferences

Name	Description	Value
applicationInsights	Application Insights references to be used on OTel metrics/logs enrichment	ApplicationInsights[]
enrichmentData	All the enrichment data sources referenced in data flows	ReferencesSpecEnrichmentData

DataCollectionRuleResourceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

DataCollectionRuleResourceProperties

Name	Description	Value
agentSettings	Agent settings used to modify agent behavior on a given host	DataCollectionRuleAgentSettings
dataCollectionEndpointId	The resource ID of the data collection endpoint that this rule can be used with.	string
dataFlows	The specification of data flows.	DataFlow[]
dataSources	The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.	DataCollectionRuleDataSources
description	Description of the data collection rule.	string
destinations	The specification of destinations.	DataCollectionRuleDestinations
directDataSources	The specification of direct data sources. This property is optional and can be omitted.	DataCollectionRuleDirectDataSources
references	Defines all the references that may be used in other sections of the DCR	DataCollectionRuleReferences
streamDeclarations	Declaration of custom streams used in this rule.	DataCollectionRuleStreamDeclarations

DataCollectionRuleResourceSku

Name	Description	Value
capacity	If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.	int
family	If the service has different generations of hardware, for the same SKU, then that can be captured here.	string
name	The name of the SKU. Ex - P3. It is typically a letter+number code	string (required)
size	The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.	string
tier	This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.	'Basic' 'Free' 'Premium' 'Standard'

DataCollectionRuleStreamDeclarations

Name	Description	Value

DataFlow

Name	Description	Value
builtInTransform	The builtIn transform to transform stream data	string
captureOverflow	Flag to enable overflow column in LA destinations	bool
destinations	List of destinations for this data flow.	string[]
outputStream	The output stream of the transform. Only required if the transform changes data to a different stream.	string
streams	List of streams for this data flow.	String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent'
transformKql	The KQL query to transform stream data.	string

DataImportSourcesEventHub

Name	Description	Value
consumerGroup	Event Hub consumer group name	string
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
stream	The stream to collect from EventHub	string

DataSourcesSpecDataImports

Name	Description	Value
eventHub	Definition of Event Hub configuration.	DataImportSourcesEventHub

DestinationsSpecAzureMonitorMetrics

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

EtwProviderDataSource

Name	Description	Value
eventIds	Events Ids to collect	string[]
keyword	Event's membership in a set of event categories	string
logLevel	Minimal level of detail to be logged	'Critical' 'Error' 'Informational' 'Verbose' 'Warning'
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
provider	The provider GUID or class name for event source	string (required)
providerType	Provider type specification: By Manifest GUID or by Event Source name	'EventSource' 'Manifest' (required)
streams	List of streams that this data source will be sent to	string[] (required)

EventHubDestination

Name	Description	Value
eventHubResourceId	The resource ID of the event hub.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

EventHubDirectDestination

Name	Description	Value
eventHubResourceId	The resource ID of the event hub.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

ExtensionDataSource

Name	Description	Value
extensionName	The name of the VM extension.	string (required)
extensionSettings	The extension settings. The format is specific for particular extension.	any
inputDataSources	The list of data sources this extension needs data from.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent'

IisLogsDataSource

Name	Description	Value
logDirectories	Absolute paths file location	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	IIS streams	string[] (required)
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

LogAnalyticsDestination

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
workspaceResourceId	The resource ID of the Log Analytics workspace.	string

LogFilesDataSource

Name	Description	Value
filePatterns	File Patterns where the log files are located	string[] (required)
format	The data format of the log files	'json' 'text' (required)
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
settings	The log files specific settings.	LogFilesDataSourceSettings
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data source	string[] (required)
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

LogFilesDataSourceSettings

Name	Description	Value
text	Text settings	LogFileSettingsText

LogFileSettingsText

Name	Description	Value
recordStartTimestampFormat	One of the supported timestamp formats	'dd/MMM/yyyy:HH:mm:ss zzz' 'ddMMyy HH:mm:ss' 'ISO 8601' 'M/D/YYYY HH:MM:SS AM/PM' 'MMM d hh:mm:ss' 'Mon DD, YYYY HH:MM:SS' 'yyMMdd HH:mm:ss' 'YYYY-MM-DD HH:MM:SS' 'yyyy-MM-ddTHH:mm:ssK' (required)

MicrosoftFabricDestination

Name	Description	Value
artifactId	The artifact id of the Microsoft Fabric resource.	string
databaseName	The name of the database to which data will be ingested.	string
ingestionUri	The ingestion uri of the Microsoft Fabric resource.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
tenantId	The tenant id of the Microsoft Fabric resource.	string

MonitoringAccountDestination

Name	Description	Value
accountResourceId	The resource ID of the monitoring account.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

OtelLogsDataSource

Name	Description	Value
enrichWithReference	Specifies the reference alias to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelLogsDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-OTel-Logs' (required)

OtelLogsDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelLogsDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-OTel-Logs' (required)

OtelMetricsDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelMetricsDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to.	string[] (required)

OtelMetricsDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelMetricsDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to.	string[] (required)

OtelTracesDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelTracesDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OTel-Traces-Events' 'Microsoft-OTel-Traces-Resources' 'Microsoft-OTel-Traces-Spans' (required)

OtelTracesDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelTracesDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OTel-Traces-Events' 'Microsoft-OTel-Traces-Resources' 'Microsoft-OTel-Traces-Spans' (required)

PerfCounterDataSource

Name	Description	Value
counterSpecifiers	A list of specifier names of the performance counters you want to collect. Use a wildcard (*) to collect a counter for all instances. To get a list of performance counters on Windows, run the command 'typeperf'.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
samplingFrequencyInSeconds	The number of seconds between consecutive counter measurements (samples).	int
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-InsightsMetrics' 'Microsoft-Perf'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

PerformanceCountersOTelDataSource

Name	Description	Value
counterSpecifiers	A list of specifier names of the performance counters you want to collect.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
samplingFrequencyInSeconds	The number of seconds between consecutive counter measurements (samples).	int
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OtelPerfMetrics'

PlatformTelemetryDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of platform telemetry streams to collect	string[] (required)

PrometheusForwarderDataSource

Name	Description	Value
customVMScrapeConfig	Custom VM Scrape Config that defines scrape jobs	any[]
labelIncludeFilter	The list of label inclusion filters in the form of label "name-value" pairs. Currently only one label is supported: 'microsoft_metrics_include_label'. Label values are matched case-insensitively.	PrometheusForwarderDataSourceLabelIncludeFilter
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-PrometheusMetrics'

PrometheusForwarderDataSourceLabelIncludeFilter

Name	Description	Value

ReferencesSpecEnrichmentData

Name	Description	Value
storageBlobs	All the storage blobs used as enrichment data sources	StorageBlob[]

StorageBlob

Name	Description	Value
blobUrl	Url of the storage blob	string
lookupType	The type of lookup to perform on the blob	'Cidr' 'String'
name	The name of the enrichment data source used as an alias when referencing this data source in data flows	string
resourceId	Resource Id of the storage account that hosts the blob	string

StorageBlobDestination

Name	Description	Value
containerName	The container name of the Storage Blob.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
storageAccountResourceId	The resource ID of the storage account.	string

StorageTableDestination

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
storageAccountResourceId	The resource ID of the storage account.	string
tableName	The name of the Storage Table.	string

StreamDeclaration

Name	Description	Value
columns	List of columns used by data in this stream.	ColumnDefinition[]

SyslogDataSource

Name	Description	Value
facilityNames	The list of facility names.	String array containing any of: '*' 'alert' 'audit' 'auth' 'authpriv' 'clock' 'cron' 'daemon' 'ftp' 'kern' 'local0' 'local1' 'local2' 'local3' 'local4' 'local5' 'local6' 'local7' 'lpr' 'mail' 'mark' 'news' 'nopri' 'ntp' 'syslog' 'user' 'uucp'
logLevels	The log levels to collect.	String array containing any of: '*' 'Alert' 'Critical' 'Debug' 'Emergency' 'Error' 'Info' 'Notice' 'Warning'
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Syslog'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

TrackedResourceTags

Name	Description	Value

UserAssignedIdentities

Name	Description	Value

UserAssignedIdentity

Name	Description	Value

WindowsEventLogDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Event' 'Microsoft-WindowsEvent'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string
xPathQueries	A list of Windows Event Log queries in XPATH format.	string[]

WindowsFirewallLogsDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
profileFilter	Firewall logs profile filter	String array containing any of: 'Domain' 'Private' 'Public'
streams	Firewall logs streams	string[] (required)

Usage Examples

Bicep Samples

A basic example of deploying Data Collection Rule.

param location string = 'westeurope'
param resourceName string = 'acctest0001'

resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
 name: resourceName
 location: location
 properties: {
 dataFlows: [
 {
 destinations: [
 'test-destination-metrics'
 ]
 streams: [
 'Microsoft-InsightsMetrics'
 ]
 }
 ]
 description: ''
 destinations: {
 azureMonitorMetrics: {
 name: 'test-destination-metrics'
 }
 }
 }
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Module	Description
Data Collection Rule	AVM Resource Module for Data Collection Rule

Azure Quickstart Samples

The following Azure Quickstart templates contain Bicep samples for deploying this resource type.

Bicep File	Description
Deploy Secure AI Foundry with a managed virtual network	This template creates a secure Azure AI Foundry environment with robust network and identity security restrictions.

ARM template resource definition

The dataCollectionRules resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/dataCollectionRules resource, add the following JSON to your template.

{
 "type": "Microsoft.Insights/dataCollectionRules",
 "apiVersion": "2024-03-11",
 "name": "string",
 "identity": {
 "type": "string",
 "userAssignedIdentities": {
 "{customized property}": {
 }
 }
 },
 "kind": "string",
 "location": "string",
 "properties": {
 "agentSettings": {
 "logs": [
 {
 "name": "string",
 "value": "string"
 }
 ]
 },
 "dataCollectionEndpointId": "string",
 "dataFlows": [
 {
 "builtInTransform": "string",
 "captureOverflow": "bool",
 "destinations": [ "string" ],
 "outputStream": "string",
 "streams": [ "string" ],
 "transformKql": "string"
 }
 ],
 "dataSources": {
 "dataImports": {
 "eventHub": {
 "consumerGroup": "string",
 "name": "string",
 "stream": "string"
 }
 },
 "etwProviders": [
 {
 "eventIds": [ "string" ],
 "keyword": "string",
 "logLevel": "string",
 "name": "string",
 "provider": "string",
 "providerType": "string",
 "streams": [ "string" ]
 }
 ],
 "extensions": [
 {
 "extensionName": "string",
 "extensionSettings": {},
 "inputDataSources": [ "string" ],
 "name": "string",
 "streams": [ "string" ]
 }
 ],
 "iisLogs": [
 {
 "logDirectories": [ "string" ],
 "name": "string",
 "streams": [ "string" ],
 "transformKql": "string"
 }
 ],
 "logFiles": [
 {
 "filePatterns": [ "string" ],
 "format": "string",
 "name": "string",
 "settings": {
 "text": {
 "recordStartTimestampFormat": "string"
 }
 },
 "streams": [ "string" ],
 "transformKql": "string"
 }
 ],
 "otelLogs": [
 {
 "enrichWithReference": "string",
 "enrichWithResourceAttributes": [ "string" ],
 "name": "string",
 "replaceResourceIdWithReference": "bool",
 "resourceAttributeRouting": {
 "attributeName": "string",
 "attributeValue": "string"
 },
 "streams": [ "string" ]
 }
 ],
 "otelMetrics": [
 {
 "enrichWithReference": "string",
 "enrichWithResourceAttributes": [ "string" ],
 "name": "string",
 "resourceAttributeRouting": {
 "attributeName": "string",
 "attributeValue": "string"
 },
 "streams": [ "string" ]
 }
 ],
 "otelTraces": [
 {
 "enrichWithReference": "string",
 "enrichWithResourceAttributes": [ "string" ],
 "name": "string",
 "replaceResourceIdWithReference": "bool",
 "resourceAttributeRouting": {
 "attributeName": "string",
 "attributeValue": "string"
 },
 "streams": [ "string" ]
 }
 ],
 "performanceCounters": [
 {
 "counterSpecifiers": [ "string" ],
 "name": "string",
 "samplingFrequencyInSeconds": "int",
 "streams": [ "string" ],
 "transformKql": "string"
 }
 ],
 "performanceCountersOTel": [
 {
 "counterSpecifiers": [ "string" ],
 "name": "string",
 "samplingFrequencyInSeconds": "int",
 "streams": [ "string" ]
 }
 ],
 "platformTelemetry": [
 {
 "name": "string",
 "streams": [ "string" ]
 }
 ],
 "prometheusForwarder": [
 {
 "customVMScrapeConfig": [ {} ],
 "labelIncludeFilter": {
 "{customized property}": "string"
 },
 "name": "string",
 "streams": [ "string" ]
 }
 ],
 "syslog": [
 {
 "facilityNames": [ "string" ],
 "logLevels": [ "string" ],
 "name": "string",
 "streams": [ "string" ],
 "transformKql": "string"
 }
 ],
 "windowsEventLogs": [
 {
 "name": "string",
 "streams": [ "string" ],
 "transformKql": "string",
 "xPathQueries": [ "string" ]
 }
 ],
 "windowsFirewallLogs": [
 {
 "name": "string",
 "profileFilter": [ "string" ],
 "streams": [ "string" ]
 }
 ]
 },
 "description": "string",
 "destinations": {
 "azureDataExplorer": [
 {
 "databaseName": "string",
 "name": "string",
 "resourceId": "string"
 }
 ],
 "azureMonitorMetrics": {
 "name": "string"
 },
 "eventHubs": [
 {
 "eventHubResourceId": "string",
 "name": "string"
 }
 ],
 "eventHubsDirect": [
 {
 "eventHubResourceId": "string",
 "name": "string"
 }
 ],
 "logAnalytics": [
 {
 "name": "string",
 "workspaceResourceId": "string"
 }
 ],
 "microsoftFabric": [
 {
 "artifactId": "string",
 "databaseName": "string",
 "ingestionUri": "string",
 "name": "string",
 "tenantId": "string"
 }
 ],
 "monitoringAccounts": [
 {
 "accountResourceId": "string",
 "name": "string"
 }
 ],
 "storageAccounts": [
 {
 "containerName": "string",
 "name": "string",
 "storageAccountResourceId": "string"
 }
 ],
 "storageBlobsDirect": [
 {
 "containerName": "string",
 "name": "string",
 "storageAccountResourceId": "string"
 }
 ],
 "storageTablesDirect": [
 {
 "name": "string",
 "storageAccountResourceId": "string",
 "tableName": "string"
 }
 ]
 },
 "directDataSources": {
 "otelLogs": [
 {
 "enrichWithReference": "string",
 "enrichWithResourceAttributes": [ "string" ],
 "name": "string",
 "replaceResourceIdWithReference": "bool",
 "streams": [ "string" ]
 }
 ],
 "otelMetrics": [
 {
 "enrichWithReference": "string",
 "enrichWithResourceAttributes": [ "string" ],
 "name": "string",
 "streams": [ "string" ]
 }
 ],
 "otelTraces": [
 {
 "enrichWithReference": "string",
 "enrichWithResourceAttributes": [ "string" ],
 "name": "string",
 "replaceResourceIdWithReference": "bool",
 "streams": [ "string" ]
 }
 ]
 },
 "references": {
 "applicationInsights": [
 {
 "name": "string",
 "resourceId": "string"
 }
 ],
 "enrichmentData": {
 "storageBlobs": [
 {
 "blobUrl": "string",
 "lookupType": "string",
 "name": "string",
 "resourceId": "string"
 }
 ]
 }
 },
 "streamDeclarations": {
 "{customized property}": {
 "columns": [
 {
 "name": "string",
 "type": "string"
 }
 ]
 }
 }
 },
 "sku": {
 "capacity": "int",
 "family": "string",
 "name": "string",
 "size": "string",
 "tier": "string"
 },
 "tags": {
 "{customized property}": "string"
 }
}

Property Values

Microsoft.Insights/dataCollectionRules

Name	Description	Value
apiVersion	The api version	'2024-03-11'
identity	Managed service identity of the resource.	DataCollectionRuleResourceIdentity
kind	The kind of the resource.	'Linux' 'Windows'
location	The geo-location where the resource lives	string (required)
name	The resource name	string (required)
properties	DataCollectionRuleResourceProperties
sku	The SKU of the resource.	DataCollectionRuleResourceSku
tags	Resource tags	Dictionary of tag names and values. See Tags in templates
type	The resource type	'Microsoft.Insights/dataCollectionRules'

AdxDestination

Name	Description	Value
databaseName	The name of the database to which data will be ingested.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
resourceId	The ARM resource id of the Adx resource.	string

AgentSetting

Name	Description	Value
name	The name of the setting. Must be part of the list of supported settings	'MaxDiskQuotaInMB' 'Tags' 'UseTimeReceivedForForwardedEvents'
value	The value of the setting	string

ApplicationInsights

Name	Description	Value
name	The name of the reference used as an alias when referencing this application insights in Otel data sources	string (required)
resourceId	Id of the application insights resource	string (required)

ColumnDefinition

Name	Description	Value
name	The name of the column.	string
type	The type of the column data.	'boolean' 'datetime' 'dynamic' 'int' 'long' 'real' 'string'

DataCollectionRuleAgentSettings

Name	Description	Value
logs	All the settings that are applicable to the logs agent (AMA)	AgentSetting[]

DataCollectionRuleDataSources

Name	Description	Value
dataImports	Specifications of pull based data sources	DataSourcesSpecDataImports
etwProviders	The list of ETW providers data source configurations.	EtwProviderDataSource[]
extensions	The list of Azure VM extension data source configurations.	ExtensionDataSource[]
iisLogs	The list of IIS logs source configurations.	IisLogsDataSource[]
logFiles	The list of Log files source configurations.	LogFilesDataSource[]
otelLogs	The list of Otel Logs data source configurations.	OtelLogsDataSource[]
otelMetrics	The list of OTel metrics data source configurations.	OtelMetricsDataSource[]
otelTraces	The list of Otel traces data source configurations.	OtelTracesDataSource[]
performanceCounters	The list of performance counter data source configurations.	PerfCounterDataSource[]
performanceCountersOTel	The list of Open Telemetry performance counter data source configurations.	PerformanceCountersOTelDataSource[]
platformTelemetry	The list of platform telemetry configurations	PlatformTelemetryDataSource[]
prometheusForwarder	The list of Prometheus forwarder data source configurations.	PrometheusForwarderDataSource[]
syslog	The list of Syslog data source configurations.	SyslogDataSource[]
windowsEventLogs	The list of Windows Event Log data source configurations.	WindowsEventLogDataSource[]
windowsFirewallLogs	The list of Windows Firewall logs source configurations.	WindowsFirewallLogsDataSource[]

DataCollectionRuleDestinations

Name	Description	Value
azureDataExplorer	List of Azure Data Explorer destinations.	AdxDestination[]
azureMonitorMetrics	Azure Monitor Metrics destination.	DestinationsSpecAzureMonitorMetrics
eventHubs	List of Event Hubs destinations.	EventHubDestination[]
eventHubsDirect	List of Event Hubs Direct destinations.	EventHubDirectDestination[]
logAnalytics	List of Log Analytics destinations.	LogAnalyticsDestination[]
microsoftFabric	List of Microsoft Fabric destinations.	MicrosoftFabricDestination[]
monitoringAccounts	List of monitoring account destinations.	MonitoringAccountDestination[]
storageAccounts	List of storage accounts destinations.	StorageBlobDestination[]
storageBlobsDirect	List of Storage Blob Direct destinations. To be used only for sending data directly to store from the agent.	StorageBlobDestination[]
storageTablesDirect	List of Storage Table Direct destinations.	StorageTableDestination[]

DataCollectionRuleDirectDataSources

Name	Description	Value
otelLogs	The list of OTel logs data source configurations.	OtelLogsDirectDataSource[]
otelMetrics	The list of OTel metrics data source configurations.	OtelMetricsDirectDataSource[]
otelTraces	The list of OTel traces data source configurations.	OtelTracesDirectDataSource[]

DataCollectionRuleReferences

Name	Description	Value
applicationInsights	Application Insights references to be used on OTel metrics/logs enrichment	ApplicationInsights[]
enrichmentData	All the enrichment data sources referenced in data flows	ReferencesSpecEnrichmentData

DataCollectionRuleResourceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

DataCollectionRuleResourceProperties

Name	Description	Value
agentSettings	Agent settings used to modify agent behavior on a given host	DataCollectionRuleAgentSettings
dataCollectionEndpointId	The resource ID of the data collection endpoint that this rule can be used with.	string
dataFlows	The specification of data flows.	DataFlow[]
dataSources	The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.	DataCollectionRuleDataSources
description	Description of the data collection rule.	string
destinations	The specification of destinations.	DataCollectionRuleDestinations
directDataSources	The specification of direct data sources. This property is optional and can be omitted.	DataCollectionRuleDirectDataSources
references	Defines all the references that may be used in other sections of the DCR	DataCollectionRuleReferences
streamDeclarations	Declaration of custom streams used in this rule.	DataCollectionRuleStreamDeclarations

DataCollectionRuleResourceSku

Name	Description	Value
capacity	If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.	int
family	If the service has different generations of hardware, for the same SKU, then that can be captured here.	string
name	The name of the SKU. Ex - P3. It is typically a letter+number code	string (required)
size	The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.	string
tier	This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.	'Basic' 'Free' 'Premium' 'Standard'

DataCollectionRuleStreamDeclarations

Name	Description	Value

DataFlow

Name	Description	Value
builtInTransform	The builtIn transform to transform stream data	string
captureOverflow	Flag to enable overflow column in LA destinations	bool
destinations	List of destinations for this data flow.	string[]
outputStream	The output stream of the transform. Only required if the transform changes data to a different stream.	string
streams	List of streams for this data flow.	String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent'
transformKql	The KQL query to transform stream data.	string

DataImportSourcesEventHub

Name	Description	Value
consumerGroup	Event Hub consumer group name	string
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
stream	The stream to collect from EventHub	string

DataSourcesSpecDataImports

Name	Description	Value
eventHub	Definition of Event Hub configuration.	DataImportSourcesEventHub

DestinationsSpecAzureMonitorMetrics

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

EtwProviderDataSource

Name	Description	Value
eventIds	Events Ids to collect	string[]
keyword	Event's membership in a set of event categories	string
logLevel	Minimal level of detail to be logged	'Critical' 'Error' 'Informational' 'Verbose' 'Warning'
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
provider	The provider GUID or class name for event source	string (required)
providerType	Provider type specification: By Manifest GUID or by Event Source name	'EventSource' 'Manifest' (required)
streams	List of streams that this data source will be sent to	string[] (required)

EventHubDestination

Name	Description	Value
eventHubResourceId	The resource ID of the event hub.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

EventHubDirectDestination

Name	Description	Value
eventHubResourceId	The resource ID of the event hub.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

ExtensionDataSource

Name	Description	Value
extensionName	The name of the VM extension.	string (required)
extensionSettings	The extension settings. The format is specific for particular extension.	any
inputDataSources	The list of data sources this extension needs data from.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent'

IisLogsDataSource

Name	Description	Value
logDirectories	Absolute paths file location	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	IIS streams	string[] (required)
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

LogAnalyticsDestination

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
workspaceResourceId	The resource ID of the Log Analytics workspace.	string

LogFilesDataSource

Name	Description	Value
filePatterns	File Patterns where the log files are located	string[] (required)
format	The data format of the log files	'json' 'text' (required)
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
settings	The log files specific settings.	LogFilesDataSourceSettings
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data source	string[] (required)
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

LogFilesDataSourceSettings

Name	Description	Value
text	Text settings	LogFileSettingsText

LogFileSettingsText

Name	Description	Value
recordStartTimestampFormat	One of the supported timestamp formats	'dd/MMM/yyyy:HH:mm:ss zzz' 'ddMMyy HH:mm:ss' 'ISO 8601' 'M/D/YYYY HH:MM:SS AM/PM' 'MMM d hh:mm:ss' 'Mon DD, YYYY HH:MM:SS' 'yyMMdd HH:mm:ss' 'YYYY-MM-DD HH:MM:SS' 'yyyy-MM-ddTHH:mm:ssK' (required)

MicrosoftFabricDestination

Name	Description	Value
artifactId	The artifact id of the Microsoft Fabric resource.	string
databaseName	The name of the database to which data will be ingested.	string
ingestionUri	The ingestion uri of the Microsoft Fabric resource.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
tenantId	The tenant id of the Microsoft Fabric resource.	string

MonitoringAccountDestination

Name	Description	Value
accountResourceId	The resource ID of the monitoring account.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

OtelLogsDataSource

Name	Description	Value
enrichWithReference	Specifies the reference alias to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelLogsDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-OTel-Logs' (required)

OtelLogsDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelLogsDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-OTel-Logs' (required)

OtelMetricsDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelMetricsDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to.	string[] (required)

OtelMetricsDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelMetricsDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to.	string[] (required)

OtelTracesDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelTracesDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OTel-Traces-Events' 'Microsoft-OTel-Traces-Resources' 'Microsoft-OTel-Traces-Spans' (required)

OtelTracesDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelTracesDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OTel-Traces-Events' 'Microsoft-OTel-Traces-Resources' 'Microsoft-OTel-Traces-Spans' (required)

PerfCounterDataSource

Name	Description	Value
counterSpecifiers	A list of specifier names of the performance counters you want to collect. Use a wildcard (*) to collect a counter for all instances. To get a list of performance counters on Windows, run the command 'typeperf'.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
samplingFrequencyInSeconds	The number of seconds between consecutive counter measurements (samples).	int
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-InsightsMetrics' 'Microsoft-Perf'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

PerformanceCountersOTelDataSource

Name	Description	Value
counterSpecifiers	A list of specifier names of the performance counters you want to collect.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
samplingFrequencyInSeconds	The number of seconds between consecutive counter measurements (samples).	int
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OtelPerfMetrics'

PlatformTelemetryDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of platform telemetry streams to collect	string[] (required)

PrometheusForwarderDataSource

Name	Description	Value
customVMScrapeConfig	Custom VM Scrape Config that defines scrape jobs	any[]
labelIncludeFilter	The list of label inclusion filters in the form of label "name-value" pairs. Currently only one label is supported: 'microsoft_metrics_include_label'. Label values are matched case-insensitively.	PrometheusForwarderDataSourceLabelIncludeFilter
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-PrometheusMetrics'

PrometheusForwarderDataSourceLabelIncludeFilter

Name	Description	Value

ReferencesSpecEnrichmentData

Name	Description	Value
storageBlobs	All the storage blobs used as enrichment data sources	StorageBlob[]

StorageBlob

Name	Description	Value
blobUrl	Url of the storage blob	string
lookupType	The type of lookup to perform on the blob	'Cidr' 'String'
name	The name of the enrichment data source used as an alias when referencing this data source in data flows	string
resourceId	Resource Id of the storage account that hosts the blob	string

StorageBlobDestination

Name	Description	Value
containerName	The container name of the Storage Blob.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
storageAccountResourceId	The resource ID of the storage account.	string

StorageTableDestination

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
storageAccountResourceId	The resource ID of the storage account.	string
tableName	The name of the Storage Table.	string

StreamDeclaration

Name	Description	Value
columns	List of columns used by data in this stream.	ColumnDefinition[]

SyslogDataSource

Name	Description	Value
facilityNames	The list of facility names.	String array containing any of: '*' 'alert' 'audit' 'auth' 'authpriv' 'clock' 'cron' 'daemon' 'ftp' 'kern' 'local0' 'local1' 'local2' 'local3' 'local4' 'local5' 'local6' 'local7' 'lpr' 'mail' 'mark' 'news' 'nopri' 'ntp' 'syslog' 'user' 'uucp'
logLevels	The log levels to collect.	String array containing any of: '*' 'Alert' 'Critical' 'Debug' 'Emergency' 'Error' 'Info' 'Notice' 'Warning'
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Syslog'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

TrackedResourceTags

Name	Description	Value

UserAssignedIdentities

Name	Description	Value

UserAssignedIdentity

Name	Description	Value

WindowsEventLogDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Event' 'Microsoft-WindowsEvent'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string
xPathQueries	A list of Windows Event Log queries in XPATH format.	string[]

WindowsFirewallLogsDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
profileFilter	Firewall logs profile filter	String array containing any of: 'Domain' 'Private' 'Public'
streams	Firewall logs streams	string[] (required)

Usage Examples

Azure Quickstart Templates

The following Azure Quickstart templates deploy this resource type.

Template	Description
Data Collection Rule for Syslog 👁 Deploy to Azure	This template creates a data collection rule defining the data source (Syslog) and the destination workspace.
Deploy Darktrace Autoscaling vSensors 👁 Deploy to Azure	This template allows you to deploy an automatically autoscaling deployment of Darktrace vSensors
Deploy Secure AI Foundry with a managed virtual network 👁 Deploy to Azure	This template creates a secure Azure AI Foundry environment with robust network and identity security restrictions.

Terraform (AzAPI provider) resource definition

The dataCollectionRules resource type can be deployed with operations that target:

Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/dataCollectionRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
 type = "Microsoft.Insights/dataCollectionRules@2024-03-11"
 name = "string"
 parent_id = "string"
 identity {
 type = "string"
 identity_ids = [
 "string"
 ]
 }
 location = "string"
 tags = {
 {customized property} = "string"
 }
 body = {
 kind = "string"
 properties = {
 agentSettings = {
 logs = [
 {
 name = "string"
 value = "string"
 }
 ]
 }
 dataCollectionEndpointId = "string"
 dataFlows = [
 {
 builtInTransform = "string"
 captureOverflow = bool
 destinations = [
 "string"
 ]
 outputStream = "string"
 streams = [
 "string"
 ]
 transformKql = "string"
 }
 ]
 dataSources = {
 dataImports = {
 eventHub = {
 consumerGroup = "string"
 name = "string"
 stream = "string"
 }
 }
 etwProviders = [
 {
 eventIds = [
 "string"
 ]
 keyword = "string"
 logLevel = "string"
 name = "string"
 provider = "string"
 providerType = "string"
 streams = [
 "string"
 ]
 }
 ]
 extensions = [
 {
 extensionName = "string"
 extensionSettings = ?
 inputDataSources = [
 "string"
 ]
 name = "string"
 streams = [
 "string"
 ]
 }
 ]
 iisLogs = [
 {
 logDirectories = [
 "string"
 ]
 name = "string"
 streams = [
 "string"
 ]
 transformKql = "string"
 }
 ]
 logFiles = [
 {
 filePatterns = [
 "string"
 ]
 format = "string"
 name = "string"
 settings = {
 text = {
 recordStartTimestampFormat = "string"
 }
 }
 streams = [
 "string"
 ]
 transformKql = "string"
 }
 ]
 otelLogs = [
 {
 enrichWithReference = "string"
 enrichWithResourceAttributes = [
 "string"
 ]
 name = "string"
 replaceResourceIdWithReference = bool
 resourceAttributeRouting = {
 attributeName = "string"
 attributeValue = "string"
 }
 streams = [
 "string"
 ]
 }
 ]
 otelMetrics = [
 {
 enrichWithReference = "string"
 enrichWithResourceAttributes = [
 "string"
 ]
 name = "string"
 resourceAttributeRouting = {
 attributeName = "string"
 attributeValue = "string"
 }
 streams = [
 "string"
 ]
 }
 ]
 otelTraces = [
 {
 enrichWithReference = "string"
 enrichWithResourceAttributes = [
 "string"
 ]
 name = "string"
 replaceResourceIdWithReference = bool
 resourceAttributeRouting = {
 attributeName = "string"
 attributeValue = "string"
 }
 streams = [
 "string"
 ]
 }
 ]
 performanceCounters = [
 {
 counterSpecifiers = [
 "string"
 ]
 name = "string"
 samplingFrequencyInSeconds = int
 streams = [
 "string"
 ]
 transformKql = "string"
 }
 ]
 performanceCountersOTel = [
 {
 counterSpecifiers = [
 "string"
 ]
 name = "string"
 samplingFrequencyInSeconds = int
 streams = [
 "string"
 ]
 }
 ]
 platformTelemetry = [
 {
 name = "string"
 streams = [
 "string"
 ]
 }
 ]
 prometheusForwarder = [
 {
 customVMScrapeConfig = [
 ?
 ]
 labelIncludeFilter = {
 {customized property} = "string"
 }
 name = "string"
 streams = [
 "string"
 ]
 }
 ]
 syslog = [
 {
 facilityNames = [
 "string"
 ]
 logLevels = [
 "string"
 ]
 name = "string"
 streams = [
 "string"
 ]
 transformKql = "string"
 }
 ]
 windowsEventLogs = [
 {
 name = "string"
 streams = [
 "string"
 ]
 transformKql = "string"
 xPathQueries = [
 "string"
 ]
 }
 ]
 windowsFirewallLogs = [
 {
 name = "string"
 profileFilter = [
 "string"
 ]
 streams = [
 "string"
 ]
 }
 ]
 }
 description = "string"
 destinations = {
 azureDataExplorer = [
 {
 databaseName = "string"
 name = "string"
 resourceId = "string"
 }
 ]
 azureMonitorMetrics = {
 name = "string"
 }
 eventHubs = [
 {
 eventHubResourceId = "string"
 name = "string"
 }
 ]
 eventHubsDirect = [
 {
 eventHubResourceId = "string"
 name = "string"
 }
 ]
 logAnalytics = [
 {
 name = "string"
 workspaceResourceId = "string"
 }
 ]
 microsoftFabric = [
 {
 artifactId = "string"
 databaseName = "string"
 ingestionUri = "string"
 name = "string"
 tenantId = "string"
 }
 ]
 monitoringAccounts = [
 {
 accountResourceId = "string"
 name = "string"
 }
 ]
 storageAccounts = [
 {
 containerName = "string"
 name = "string"
 storageAccountResourceId = "string"
 }
 ]
 storageBlobsDirect = [
 {
 containerName = "string"
 name = "string"
 storageAccountResourceId = "string"
 }
 ]
 storageTablesDirect = [
 {
 name = "string"
 storageAccountResourceId = "string"
 tableName = "string"
 }
 ]
 }
 directDataSources = {
 otelLogs = [
 {
 enrichWithReference = "string"
 enrichWithResourceAttributes = [
 "string"
 ]
 name = "string"
 replaceResourceIdWithReference = bool
 streams = [
 "string"
 ]
 }
 ]
 otelMetrics = [
 {
 enrichWithReference = "string"
 enrichWithResourceAttributes = [
 "string"
 ]
 name = "string"
 streams = [
 "string"
 ]
 }
 ]
 otelTraces = [
 {
 enrichWithReference = "string"
 enrichWithResourceAttributes = [
 "string"
 ]
 name = "string"
 replaceResourceIdWithReference = bool
 streams = [
 "string"
 ]
 }
 ]
 }
 references = {
 applicationInsights = [
 {
 name = "string"
 resourceId = "string"
 }
 ]
 enrichmentData = {
 storageBlobs = [
 {
 blobUrl = "string"
 lookupType = "string"
 name = "string"
 resourceId = "string"
 }
 ]
 }
 }
 streamDeclarations = {
 {customized property} = {
 columns = [
 {
 name = "string"
 type = "string"
 }
 ]
 }
 }
 }
 sku = {
 capacity = int
 family = "string"
 name = "string"
 size = "string"
 tier = "string"
 }
 }
}

Property Values

Microsoft.Insights/dataCollectionRules

Name	Description	Value
identity	Managed service identity of the resource.	DataCollectionRuleResourceIdentity
kind	The kind of the resource.	'Linux' 'Windows'
location	The geo-location where the resource lives	string (required)
name	The resource name	string (required)
properties	DataCollectionRuleResourceProperties
sku	The SKU of the resource.	DataCollectionRuleResourceSku
tags	Resource tags	Dictionary of tag names and values.
type	The resource type	"Microsoft.Insights/dataCollectionRules@2024-03-11"

AdxDestination

Name	Description	Value
databaseName	The name of the database to which data will be ingested.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
resourceId	The ARM resource id of the Adx resource.	string

AgentSetting

Name	Description	Value
name	The name of the setting. Must be part of the list of supported settings	'MaxDiskQuotaInMB' 'Tags' 'UseTimeReceivedForForwardedEvents'
value	The value of the setting	string

ApplicationInsights

Name	Description	Value
name	The name of the reference used as an alias when referencing this application insights in Otel data sources	string (required)
resourceId	Id of the application insights resource	string (required)

ColumnDefinition

Name	Description	Value
name	The name of the column.	string
type	The type of the column data.	'boolean' 'datetime' 'dynamic' 'int' 'long' 'real' 'string'

DataCollectionRuleAgentSettings

Name	Description	Value
logs	All the settings that are applicable to the logs agent (AMA)	AgentSetting[]

DataCollectionRuleDataSources

Name	Description	Value
dataImports	Specifications of pull based data sources	DataSourcesSpecDataImports
etwProviders	The list of ETW providers data source configurations.	EtwProviderDataSource[]
extensions	The list of Azure VM extension data source configurations.	ExtensionDataSource[]
iisLogs	The list of IIS logs source configurations.	IisLogsDataSource[]
logFiles	The list of Log files source configurations.	LogFilesDataSource[]
otelLogs	The list of Otel Logs data source configurations.	OtelLogsDataSource[]
otelMetrics	The list of OTel metrics data source configurations.	OtelMetricsDataSource[]
otelTraces	The list of Otel traces data source configurations.	OtelTracesDataSource[]
performanceCounters	The list of performance counter data source configurations.	PerfCounterDataSource[]
performanceCountersOTel	The list of Open Telemetry performance counter data source configurations.	PerformanceCountersOTelDataSource[]
platformTelemetry	The list of platform telemetry configurations	PlatformTelemetryDataSource[]
prometheusForwarder	The list of Prometheus forwarder data source configurations.	PrometheusForwarderDataSource[]
syslog	The list of Syslog data source configurations.	SyslogDataSource[]
windowsEventLogs	The list of Windows Event Log data source configurations.	WindowsEventLogDataSource[]
windowsFirewallLogs	The list of Windows Firewall logs source configurations.	WindowsFirewallLogsDataSource[]

DataCollectionRuleDestinations

Name	Description	Value
azureDataExplorer	List of Azure Data Explorer destinations.	AdxDestination[]
azureMonitorMetrics	Azure Monitor Metrics destination.	DestinationsSpecAzureMonitorMetrics
eventHubs	List of Event Hubs destinations.	EventHubDestination[]
eventHubsDirect	List of Event Hubs Direct destinations.	EventHubDirectDestination[]
logAnalytics	List of Log Analytics destinations.	LogAnalyticsDestination[]
microsoftFabric	List of Microsoft Fabric destinations.	MicrosoftFabricDestination[]
monitoringAccounts	List of monitoring account destinations.	MonitoringAccountDestination[]
storageAccounts	List of storage accounts destinations.	StorageBlobDestination[]
storageBlobsDirect	List of Storage Blob Direct destinations. To be used only for sending data directly to store from the agent.	StorageBlobDestination[]
storageTablesDirect	List of Storage Table Direct destinations.	StorageTableDestination[]

DataCollectionRuleDirectDataSources

Name	Description	Value
otelLogs	The list of OTel logs data source configurations.	OtelLogsDirectDataSource[]
otelMetrics	The list of OTel metrics data source configurations.	OtelMetricsDirectDataSource[]
otelTraces	The list of OTel traces data source configurations.	OtelTracesDirectDataSource[]

DataCollectionRuleReferences

Name	Description	Value
applicationInsights	Application Insights references to be used on OTel metrics/logs enrichment	ApplicationInsights[]
enrichmentData	All the enrichment data sources referenced in data flows	ReferencesSpecEnrichmentData

DataCollectionRuleResourceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

DataCollectionRuleResourceProperties

Name	Description	Value
agentSettings	Agent settings used to modify agent behavior on a given host	DataCollectionRuleAgentSettings
dataCollectionEndpointId	The resource ID of the data collection endpoint that this rule can be used with.	string
dataFlows	The specification of data flows.	DataFlow[]
dataSources	The specification of data sources. This property is optional and can be omitted if the rule is meant to be used via direct calls to the provisioned endpoint.	DataCollectionRuleDataSources
description	Description of the data collection rule.	string
destinations	The specification of destinations.	DataCollectionRuleDestinations
directDataSources	The specification of direct data sources. This property is optional and can be omitted.	DataCollectionRuleDirectDataSources
references	Defines all the references that may be used in other sections of the DCR	DataCollectionRuleReferences
streamDeclarations	Declaration of custom streams used in this rule.	DataCollectionRuleStreamDeclarations

DataCollectionRuleResourceSku

Name	Description	Value
capacity	If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.	int
family	If the service has different generations of hardware, for the same SKU, then that can be captured here.	string
name	The name of the SKU. Ex - P3. It is typically a letter+number code	string (required)
size	The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.	string
tier	This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.	'Basic' 'Free' 'Premium' 'Standard'

DataCollectionRuleStreamDeclarations

Name	Description	Value

DataFlow

Name	Description	Value
builtInTransform	The builtIn transform to transform stream data	string
captureOverflow	Flag to enable overflow column in LA destinations	bool
destinations	List of destinations for this data flow.	string[]
outputStream	The output stream of the transform. Only required if the transform changes data to a different stream.	string
streams	List of streams for this data flow.	String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent'
transformKql	The KQL query to transform stream data.	string

DataImportSourcesEventHub

Name	Description	Value
consumerGroup	Event Hub consumer group name	string
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
stream	The stream to collect from EventHub	string

DataSourcesSpecDataImports

Name	Description	Value
eventHub	Definition of Event Hub configuration.	DataImportSourcesEventHub

DestinationsSpecAzureMonitorMetrics

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

EtwProviderDataSource

Name	Description	Value
eventIds	Events Ids to collect	string[]
keyword	Event's membership in a set of event categories	string
logLevel	Minimal level of detail to be logged	'Critical' 'Error' 'Informational' 'Verbose' 'Warning'
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
provider	The provider GUID or class name for event source	string (required)
providerType	Provider type specification: By Manifest GUID or by Event Source name	'EventSource' 'Manifest' (required)
streams	List of streams that this data source will be sent to	string[] (required)

EventHubDestination

Name	Description	Value
eventHubResourceId	The resource ID of the event hub.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

EventHubDirectDestination

Name	Description	Value
eventHubResourceId	The resource ID of the event hub.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

ExtensionDataSource

Name	Description	Value
extensionName	The name of the VM extension.	string (required)
extensionSettings	The extension settings. The format is specific for particular extension.	any
inputDataSources	The list of data sources this extension needs data from.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Event' 'Microsoft-InsightsMetrics' 'Microsoft-Perf' 'Microsoft-Syslog' 'Microsoft-WindowsEvent'

IisLogsDataSource

Name	Description	Value
logDirectories	Absolute paths file location	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	IIS streams	string[] (required)
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

LogAnalyticsDestination

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
workspaceResourceId	The resource ID of the Log Analytics workspace.	string

LogFilesDataSource

Name	Description	Value
filePatterns	File Patterns where the log files are located	string[] (required)
format	The data format of the log files	'json' 'text' (required)
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
settings	The log files specific settings.	LogFilesDataSourceSettings
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data source	string[] (required)
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

LogFilesDataSourceSettings

Name	Description	Value
text	Text settings	LogFileSettingsText

LogFileSettingsText

Name	Description	Value
recordStartTimestampFormat	One of the supported timestamp formats	'dd/MMM/yyyy:HH:mm:ss zzz' 'ddMMyy HH:mm:ss' 'ISO 8601' 'M/D/YYYY HH:MM:SS AM/PM' 'MMM d hh:mm:ss' 'Mon DD, YYYY HH:MM:SS' 'yyMMdd HH:mm:ss' 'YYYY-MM-DD HH:MM:SS' 'yyyy-MM-ddTHH:mm:ssK' (required)

MicrosoftFabricDestination

Name	Description	Value
artifactId	The artifact id of the Microsoft Fabric resource.	string
databaseName	The name of the database to which data will be ingested.	string
ingestionUri	The ingestion uri of the Microsoft Fabric resource.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
tenantId	The tenant id of the Microsoft Fabric resource.	string

MonitoringAccountDestination

Name	Description	Value
accountResourceId	The resource ID of the monitoring account.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string

OtelLogsDataSource

Name	Description	Value
enrichWithReference	Specifies the reference alias to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelLogsDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-OTel-Logs' (required)

OtelLogsDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelLogsDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-OTel-Logs' (required)

OtelMetricsDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelMetricsDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to.	string[] (required)

OtelMetricsDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelMetricsDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to.	string[] (required)

OtelTracesDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
resourceAttributeRouting	Specifies the routing policy based on OTLP payload resource attributes to route subset of the payload according to matching resource attribute.	OtelTracesDataSourceResourceAttributeRouting
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OTel-Traces-Events' 'Microsoft-OTel-Traces-Resources' 'Microsoft-OTel-Traces-Spans' (required)

OtelTracesDataSourceResourceAttributeRouting

Name	Description	Value
attributeName	The name of the resource attribute to match.	string
attributeValue	The value of the resource attribute to match.	string

OtelTracesDirectDataSource

Name	Description	Value
enrichWithReference	Specifies the reference to enrich the telemetry signal with.	string
enrichWithResourceAttributes	Specifies the list of resource attributes that need to be added as labels/dimensions to the telemetry data for further enrichment.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
replaceResourceIdWithReference	Specifies whether to replace the default resourceId in the log record with the resourceId of the referenced resource being used for enrichment.	bool
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OTel-Traces-Events' 'Microsoft-OTel-Traces-Resources' 'Microsoft-OTel-Traces-Spans' (required)

PerfCounterDataSource

Name	Description	Value
counterSpecifiers	A list of specifier names of the performance counters you want to collect. Use a wildcard (*) to collect a counter for all instances. To get a list of performance counters on Windows, run the command 'typeperf'.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
samplingFrequencyInSeconds	The number of seconds between consecutive counter measurements (samples).	int
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-InsightsMetrics' 'Microsoft-Perf'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

PerformanceCountersOTelDataSource

Name	Description	Value
counterSpecifiers	A list of specifier names of the performance counters you want to collect.	string[]
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
samplingFrequencyInSeconds	The number of seconds between consecutive counter measurements (samples).	int
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-OtelPerfMetrics'

PlatformTelemetryDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of platform telemetry streams to collect	string[] (required)

PrometheusForwarderDataSource

Name	Description	Value
customVMScrapeConfig	Custom VM Scrape Config that defines scrape jobs	any[]
labelIncludeFilter	The list of label inclusion filters in the form of label "name-value" pairs. Currently only one label is supported: 'microsoft_metrics_include_label'. Label values are matched case-insensitively.	PrometheusForwarderDataSourceLabelIncludeFilter
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to.	String array containing any of: 'Microsoft-PrometheusMetrics'

PrometheusForwarderDataSourceLabelIncludeFilter

Name	Description	Value

ReferencesSpecEnrichmentData

Name	Description	Value
storageBlobs	All the storage blobs used as enrichment data sources	StorageBlob[]

StorageBlob

Name	Description	Value
blobUrl	Url of the storage blob	string
lookupType	The type of lookup to perform on the blob	'Cidr' 'String'
name	The name of the enrichment data source used as an alias when referencing this data source in data flows	string
resourceId	Resource Id of the storage account that hosts the blob	string

StorageBlobDestination

Name	Description	Value
containerName	The container name of the Storage Blob.	string
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
storageAccountResourceId	The resource ID of the storage account.	string

StorageTableDestination

Name	Description	Value
name	A friendly name for the destination. This name should be unique across all destinations (regardless of type) within the data collection rule.	string
storageAccountResourceId	The resource ID of the storage account.	string
tableName	The name of the Storage Table.	string

StreamDeclaration

Name	Description	Value
columns	List of columns used by data in this stream.	ColumnDefinition[]

SyslogDataSource

Name	Description	Value
facilityNames	The list of facility names.	String array containing any of: '*' 'alert' 'audit' 'auth' 'authpriv' 'clock' 'cron' 'daemon' 'ftp' 'kern' 'local0' 'local1' 'local2' 'local3' 'local4' 'local5' 'local6' 'local7' 'lpr' 'mail' 'mark' 'news' 'nopri' 'ntp' 'syslog' 'user' 'uucp'
logLevels	The log levels to collect.	String array containing any of: '*' 'Alert' 'Critical' 'Debug' 'Emergency' 'Error' 'Info' 'Notice' 'Warning'
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Syslog'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string

TrackedResourceTags

Name	Description	Value

UserAssignedIdentities

Name	Description	Value

UserAssignedIdentity

Name	Description	Value

WindowsEventLogDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
streams	List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.	String array containing any of: 'Microsoft-Event' 'Microsoft-WindowsEvent'
transformKql	The KQL query to transform the data source. This is a deprecated property and will be removed in future versions.	string
xPathQueries	A list of Windows Event Log queries in XPATH format.	string[]

WindowsFirewallLogsDataSource

Name	Description	Value
name	A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.	string
profileFilter	Firewall logs profile filter	String array containing any of: 'Domain' 'Private' 'Public'
streams	Firewall logs streams	string[] (required)

Usage Examples

Terraform Samples

A basic example of deploying Data Collection Rule.

terraform {
 required_providers {
 azapi = {
 source = "Azure/azapi"
 }
 }
}

provider "azapi" {
 skip_provider_registration = false
}

variable "resource_name" {
 type = string
 default = "acctest0001"
}

variable "location" {
 type = string
 default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
 type = "Microsoft.Resources/resourceGroups@2020-06-01"
 name = var.resource_name
 location = var.location
}

resource "azapi_resource" "dataCollectionRule" {
 type = "Microsoft.Insights/dataCollectionRules@2022-06-01"
 parent_id = azapi_resource.resourceGroup.id
 name = var.resource_name
 location = var.location
 body = {
 properties = {
 dataFlows = [
 {
 destinations = [
 "test-destination-metrics",
 ]
 streams = [
 "Microsoft-InsightsMetrics",
 ]
 },
 ]
 description = ""
 destinations = {
 azureMonitorMetrics = {
 name = "test-destination-metrics"
 }
 }
 }
 }
 schema_validation_enabled = false
 response_export_values = ["*"]
}

Feedback

Was this page helpful?

Additional resources

Last updated on

URL: https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/datacollectionrules?pivots=deployment-language-arm-template

⇱ Microsoft.Insights/dataCollectionRules - Bicep, ARM template & Terraform AzAPI reference | Microsoft Learn

Microsoft.Insights dataCollectionRules

Bicep resource definition

Resource format

Property Values

Microsoft.Insights/dataCollectionRules

AdxDestination

AgentSetting

ApplicationInsights

ColumnDefinition

DataCollectionRuleAgentSettings

DataCollectionRuleDataSources

DataCollectionRuleDestinations

DataCollectionRuleDirectDataSources

DataCollectionRuleReferences

DataCollectionRuleResourceIdentity

DataCollectionRuleResourceProperties

DataCollectionRuleResourceSku

DataCollectionRuleStreamDeclarations

DataFlow

DataImportSourcesEventHub

DataSourcesSpecDataImports

DestinationsSpecAzureMonitorMetrics

EtwProviderDataSource

EventHubDestination

EventHubDirectDestination

ExtensionDataSource

IisLogsDataSource

LogAnalyticsDestination

LogFilesDataSource

LogFilesDataSourceSettings

LogFileSettingsText

MicrosoftFabricDestination

MonitoringAccountDestination

OtelLogsDataSource

OtelLogsDataSourceResourceAttributeRouting

OtelLogsDirectDataSource

OtelMetricsDataSource

OtelMetricsDataSourceResourceAttributeRouting

OtelMetricsDirectDataSource

OtelTracesDataSource

OtelTracesDataSourceResourceAttributeRouting

OtelTracesDirectDataSource

PerfCounterDataSource

PerformanceCountersOTelDataSource

PlatformTelemetryDataSource

PrometheusForwarderDataSource

PrometheusForwarderDataSourceLabelIncludeFilter

ReferencesSpecEnrichmentData

StorageBlob

StorageBlobDestination

StorageTableDestination

StreamDeclaration

SyslogDataSource

TrackedResourceTags

UserAssignedIdentities

UserAssignedIdentity

WindowsEventLogDataSource

WindowsFirewallLogsDataSource

Usage Examples

Bicep Samples

Azure Verified Modules

Azure Quickstart Samples

ARM template resource definition

Resource format

Property Values

Microsoft.Insights/dataCollectionRules

AdxDestination

AgentSetting

ApplicationInsights

ColumnDefinition

DataCollectionRuleAgentSettings

DataCollectionRuleDataSources

DataCollectionRuleDestinations

DataCollectionRuleDirectDataSources

DataCollectionRuleReferences

DataCollectionRuleResourceIdentity

DataCollectionRuleResourceProperties

DataCollectionRuleResourceSku