azure-resources/log-analytics-workspace/logAnalyticsWorkspace.json
|
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.43.8.12551", "templateHash": "11043045321227478926" } }, "parameters": { "workspaceName": { "type": "string", "defaultValue": "[format('law-{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the Log Analytics workspace" } }, "servicePrincipalId": { "type": "string", "metadata": { "description": "The principal ID of the service principal to grant permissions" } }, "deployAuditLogsDCR": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to deploy the audit logs DCR and custom table" } }, "deployRunbookLogsDCR": { "type": "bool", "defaultValue": false, "metadata": { "description": "Whether to deploy the runbook logs DCR and custom table" } }, "deployOperationalLogsDCR": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to deploy the operational logs DCR and custom table" } }, "assignWorkspaceRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Log Analytics Contributor role on the workspace" } }, "assignAuditLogsDcrRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Monitoring Metrics Publisher role on the audit logs DCR" } }, "assignRunbookLogsDcrRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Monitoring Metrics Publisher role on the runbook logs DCR" } }, "assignOperationalLogsDcrRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Monitoring Metrics Publisher role on the operational logs DCR" } }, "logAnalyticsReaderRoleId": { "type": "string", "metadata": { "description": "The Log Analytics Reader role definition ID" } }, "monitoringMetricsPublisherRoleId": { "type": "string", "metadata": { "description": "The Monitoring Metrics Publisher role definition ID" } } }, "variables": { "uniqueId": "[uniqueString(resourceGroup().id, parameters('workspaceName'))]", "auditLogsTableName": "RJAuditLogs_CL", "auditLogsStreamName": "[format('Custom-{0}', variables('auditLogsTableName'))]", "auditLogsDcrName": "[format('dcr-rj-aud-logs-{0}', variables('uniqueId'))]", "runbookLogsTableName": "RJRunbookLogs_CL", "runbookLogsStreamName": "[format('Custom-{0}', variables('runbookLogsTableName'))]", "runbookLogsDcrName": "[format('dcr-rj-rb-logs-{0}', variables('uniqueId'))]", "operationalLogsTableName": "RJOperationalLogs_CL", "operationalLogsStreamName": "[format('Custom-{0}', variables('operationalLogsTableName'))]", "operationalLogsDcrName": "[format('dcr-rj-op-logs-{0}', variables('uniqueId'))]", "auditLogsColumns": [ { "name": "TimeGenerated", "type": "DateTime" }, { "name": "Level", "type": "String" }, { "name": "Message", "type": "String" }, { "name": "Exception", "type": "String" }, { "name": "CustomerTenantId", "type": "String" }, { "name": "Category", "type": "String" }, { "name": "LogType", "type": "String" }, { "name": "Subject", "type": "Dynamic" }, { "name": "Target", "type": "Dynamic" }, { "name": "Change", "type": "Dynamic" }, { "name": "Context", "type": "Dynamic" }, { "name": "UserName", "type": "String" }, { "name": "UserId", "type": "String" }, { "name": "SourceContext", "type": "String" }, { "name": "RequestId", "type": "String" }, { "name": "EnvironmentName", "type": "String" }, { "name": "Diagnostics", "type": "Dynamic" } ], "runbookLogsColumns": [ { "name": "TimeGenerated", "type": "DateTime" }, { "name": "JobCreationTime", "type": "DateTime" }, { "name": "JobEndTime", "type": "DateTime" }, { "name": "JobException", "type": "String" }, { "name": "JobId", "type": "String" }, { "name": "JobJobId", "type": "String" }, { "name": "JobLastModifiedTime", "type": "DateTime" }, { "name": "JobLastStatusModifiedTime", "type": "DateTime" }, { "name": "JobName", "type": "String" }, { "name": "JobOutput", "type": "String" }, { "name": "JobParametersJson", "type": "String" }, { "name": "JobPrettyCategory", "type": "String" }, { "name": "JobPrettyName", "type": "String" }, { "name": "JobPrettyType", "type": "String" }, { "name": "JobProvisioningState", "type": "String" }, { "name": "JobRunbookName", "type": "String" }, { "name": "JobRunOn", "type": "String" }, { "name": "JobStartedBy", "type": "String" }, { "name": "JobStartTime", "type": "DateTime" }, { "name": "JobStatus", "type": "String" }, { "name": "JobStatusDetails", "type": "String" }, { "name": "JobStreamsJson", "type": "String" }, { "name": "JobType", "type": "String" } ], "operationalLogsColumns": [ { "name": "TimeGenerated", "type": "DateTime" }, { "name": "Level", "type": "String" }, { "name": "Message", "type": "String" }, { "name": "Exception", "type": "String" }, { "name": "CustomerTenantId", "type": "String" }, { "name": "Category", "type": "String" }, { "name": "LogType", "type": "String" }, { "name": "SourceContext", "type": "String" }, { "name": "RequestId", "type": "String" }, { "name": "EnvironmentName", "type": "String" }, { "name": "Diagnostics", "type": "Dynamic" }, { "name": "Context", "type": "Dynamic" } ] }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces", "apiVersion": "2025-07-01", "name": "[parameters('workspaceName')]", "location": "[resourceGroup().location]" }, { "condition": "[parameters('assignWorkspaceRole')]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]", "name": "[guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), parameters('servicePrincipalId'), parameters('logAnalyticsReaderRoleId'))]", "properties": { "principalId": "[parameters('servicePrincipalId')]", "principalType": "ServicePrincipal", "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('logAnalyticsReaderRoleId'))]" }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]" ] }, { "condition": "[parameters('deployAuditLogsDCR')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2025-04-01", "name": "auditLogsDcr", "properties": { "expressionEvaluationOptions": { "scope": "inner" }, "mode": "Incremental", "parameters": { "workspaceName": { "value": "[parameters('workspaceName')]" }, "tableName": { "value": "[variables('auditLogsTableName')]" }, "dcrName": { "value": "[variables('auditLogsDcrName')]" }, "streamName": { "value": "[variables('auditLogsStreamName')]" }, "columns": { "value": "[variables('auditLogsColumns')]" }, "servicePrincipalId": { "value": "[parameters('servicePrincipalId')]" }, "location": { "value": "[resourceGroup().location]" }, "assignDcrRole": { "value": "[parameters('assignAuditLogsDcrRole')]" }, "monitoringMetricsPublisherRoleId": { "value": "[parameters('monitoringMetricsPublisherRoleId')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.43.8.12551", "templateHash": "9621932049544764087" } }, "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "The name of the Log Analytics workspace" } }, "tableName": { "type": "string", "metadata": { "description": "The name of the custom table (must end with _CL)" } }, "dcrName": { "type": "string", "metadata": { "description": "The name of the DCR" } }, "streamName": { "type": "string", "metadata": { "description": "The name of the stream (e.g., Custom-RJAuditLogs_CL)" } }, "columns": { "type": "array", "metadata": { "description": "The columns for the custom table and DCR (Pascal case: DateTime, String, Dynamic)" } }, "servicePrincipalId": { "type": "string", "metadata": { "description": "The service principal ID for role assignments" } }, "location": { "type": "string", "metadata": { "description": "Azure region" } }, "assignDcrRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Monitoring Metrics Publisher role to the service principal on the DCR" } }, "monitoringMetricsPublisherRoleId": { "type": "string", "metadata": { "description": "The Monitoring Metrics Publisher role definition ID" } } }, "variables": { "copy": [ { "name": "dcrColumns", "count": "[length(parameters('columns'))]", "input": { "name": "[parameters('columns')[copyIndex('dcrColumns')].name]", "type": "[toLower(parameters('columns')[copyIndex('dcrColumns')].type)]" } } ], "logsDestinationName": "RJLogAnalyticsDestination" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2025-07-01", "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('tableName'))]", "properties": { "schema": { "name": "[parameters('tableName')]", "columns": "[parameters('columns')]" } } }, { "type": "Microsoft.Insights/dataCollectionRules", "apiVersion": "2024-03-11", "name": "[parameters('dcrName')]", "location": "[parameters('location')]", "kind": "Direct", "identity": { "type": "SystemAssigned" }, "properties": { "streamDeclarations": { "[format('{0}', parameters('streamName'))]": { "columns": "[variables('dcrColumns')]" } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]", "name": "[variables('logsDestinationName')]" } ] }, "dataFlows": [ { "streams": [ "[parameters('streamName')]" ], "destinations": [ "[variables('logsDestinationName')]" ], "transformKql": "source", "outputStream": "[parameters('streamName')]" } ] }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('tableName'))]" ] }, { "condition": "[parameters('assignDcrRole')]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]", "name": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), parameters('servicePrincipalId'), parameters('monitoringMetricsPublisherRoleId'))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('monitoringMetricsPublisherRoleId'))]", "principalId": "[parameters('servicePrincipalId')]", "principalType": "ServicePrincipal" }, "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]" ] } ], "outputs": { "dcrId": { "type": "string", "metadata": { "description": "The resource ID of the DCR" }, "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]" }, "dcrImmutableId": { "type": "string", "metadata": { "description": "The immutable ID of the DCR" }, "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), '2024-03-11').immutableId]" }, "logsIngestionEndpoint": { "type": "string", "metadata": { "description": "The logs ingestion endpoint" }, "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), '2024-03-11').endpoints.logsIngestion]" }, "streamName": { "type": "string", "metadata": { "description": "The stream name for the DCR" }, "value": "[parameters('streamName')]" } } } }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]" ] }, { "condition": "[parameters('deployRunbookLogsDCR')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2025-04-01", "name": "runbookLogsDcr", "properties": { "expressionEvaluationOptions": { "scope": "inner" }, "mode": "Incremental", "parameters": { "workspaceName": { "value": "[parameters('workspaceName')]" }, "tableName": { "value": "[variables('runbookLogsTableName')]" }, "dcrName": { "value": "[variables('runbookLogsDcrName')]" }, "streamName": { "value": "[variables('runbookLogsStreamName')]" }, "columns": { "value": "[variables('runbookLogsColumns')]" }, "servicePrincipalId": { "value": "[parameters('servicePrincipalId')]" }, "location": { "value": "[resourceGroup().location]" }, "assignDcrRole": { "value": "[parameters('assignRunbookLogsDcrRole')]" }, "monitoringMetricsPublisherRoleId": { "value": "[parameters('monitoringMetricsPublisherRoleId')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.43.8.12551", "templateHash": "9621932049544764087" } }, "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "The name of the Log Analytics workspace" } }, "tableName": { "type": "string", "metadata": { "description": "The name of the custom table (must end with _CL)" } }, "dcrName": { "type": "string", "metadata": { "description": "The name of the DCR" } }, "streamName": { "type": "string", "metadata": { "description": "The name of the stream (e.g., Custom-RJAuditLogs_CL)" } }, "columns": { "type": "array", "metadata": { "description": "The columns for the custom table and DCR (Pascal case: DateTime, String, Dynamic)" } }, "servicePrincipalId": { "type": "string", "metadata": { "description": "The service principal ID for role assignments" } }, "location": { "type": "string", "metadata": { "description": "Azure region" } }, "assignDcrRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Monitoring Metrics Publisher role to the service principal on the DCR" } }, "monitoringMetricsPublisherRoleId": { "type": "string", "metadata": { "description": "The Monitoring Metrics Publisher role definition ID" } } }, "variables": { "copy": [ { "name": "dcrColumns", "count": "[length(parameters('columns'))]", "input": { "name": "[parameters('columns')[copyIndex('dcrColumns')].name]", "type": "[toLower(parameters('columns')[copyIndex('dcrColumns')].type)]" } } ], "logsDestinationName": "RJLogAnalyticsDestination" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2025-07-01", "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('tableName'))]", "properties": { "schema": { "name": "[parameters('tableName')]", "columns": "[parameters('columns')]" } } }, { "type": "Microsoft.Insights/dataCollectionRules", "apiVersion": "2024-03-11", "name": "[parameters('dcrName')]", "location": "[parameters('location')]", "kind": "Direct", "identity": { "type": "SystemAssigned" }, "properties": { "streamDeclarations": { "[format('{0}', parameters('streamName'))]": { "columns": "[variables('dcrColumns')]" } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]", "name": "[variables('logsDestinationName')]" } ] }, "dataFlows": [ { "streams": [ "[parameters('streamName')]" ], "destinations": [ "[variables('logsDestinationName')]" ], "transformKql": "source", "outputStream": "[parameters('streamName')]" } ] }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('tableName'))]" ] }, { "condition": "[parameters('assignDcrRole')]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]", "name": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), parameters('servicePrincipalId'), parameters('monitoringMetricsPublisherRoleId'))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('monitoringMetricsPublisherRoleId'))]", "principalId": "[parameters('servicePrincipalId')]", "principalType": "ServicePrincipal" }, "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]" ] } ], "outputs": { "dcrId": { "type": "string", "metadata": { "description": "The resource ID of the DCR" }, "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]" }, "dcrImmutableId": { "type": "string", "metadata": { "description": "The immutable ID of the DCR" }, "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), '2024-03-11').immutableId]" }, "logsIngestionEndpoint": { "type": "string", "metadata": { "description": "The logs ingestion endpoint" }, "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), '2024-03-11').endpoints.logsIngestion]" }, "streamName": { "type": "string", "metadata": { "description": "The stream name for the DCR" }, "value": "[parameters('streamName')]" } } } }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]" ] }, { "condition": "[parameters('deployOperationalLogsDCR')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2025-04-01", "name": "operationalLogsDcr", "properties": { "expressionEvaluationOptions": { "scope": "inner" }, "mode": "Incremental", "parameters": { "workspaceName": { "value": "[parameters('workspaceName')]" }, "tableName": { "value": "[variables('operationalLogsTableName')]" }, "dcrName": { "value": "[variables('operationalLogsDcrName')]" }, "streamName": { "value": "[variables('operationalLogsStreamName')]" }, "columns": { "value": "[variables('operationalLogsColumns')]" }, "servicePrincipalId": { "value": "[parameters('servicePrincipalId')]" }, "location": { "value": "[resourceGroup().location]" }, "assignDcrRole": { "value": "[parameters('assignOperationalLogsDcrRole')]" }, "monitoringMetricsPublisherRoleId": { "value": "[parameters('monitoringMetricsPublisherRoleId')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.43.8.12551", "templateHash": "9621932049544764087" } }, "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "The name of the Log Analytics workspace" } }, "tableName": { "type": "string", "metadata": { "description": "The name of the custom table (must end with _CL)" } }, "dcrName": { "type": "string", "metadata": { "description": "The name of the DCR" } }, "streamName": { "type": "string", "metadata": { "description": "The name of the stream (e.g., Custom-RJAuditLogs_CL)" } }, "columns": { "type": "array", "metadata": { "description": "The columns for the custom table and DCR (Pascal case: DateTime, String, Dynamic)" } }, "servicePrincipalId": { "type": "string", "metadata": { "description": "The service principal ID for role assignments" } }, "location": { "type": "string", "metadata": { "description": "Azure region" } }, "assignDcrRole": { "type": "bool", "defaultValue": true, "metadata": { "description": "Whether to assign the Monitoring Metrics Publisher role to the service principal on the DCR" } }, "monitoringMetricsPublisherRoleId": { "type": "string", "metadata": { "description": "The Monitoring Metrics Publisher role definition ID" } } }, "variables": { "copy": [ { "name": "dcrColumns", "count": "[length(parameters('columns'))]", "input": { "name": "[parameters('columns')[copyIndex('dcrColumns')].name]", "type": "[toLower(parameters('columns')[copyIndex('dcrColumns')].type)]" } } ], "logsDestinationName": "RJLogAnalyticsDestination" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2025-07-01", "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('tableName'))]", "properties": { "schema": { "name": "[parameters('tableName')]", "columns": "[parameters('columns')]" } } }, { "type": "Microsoft.Insights/dataCollectionRules", "apiVersion": "2024-03-11", "name": "[parameters('dcrName')]", "location": "[parameters('location')]", "kind": "Direct", "identity": { "type": "SystemAssigned" }, "properties": { "streamDeclarations": { "[format('{0}', parameters('streamName'))]": { "columns": "[variables('dcrColumns')]" } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]", "name": "[variables('logsDestinationName')]" } ] }, "dataFlows": [ { "streams": [ "[parameters('streamName')]" ], "destinations": [ "[variables('logsDestinationName')]" ], "transformKql": "source", "outputStream": "[parameters('streamName')]" } ] }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('tableName'))]" ] }, { "condition": "[parameters('assignDcrRole')]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]", "name": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), parameters('servicePrincipalId'), parameters('monitoringMetricsPublisherRoleId'))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('monitoringMetricsPublisherRoleId'))]", "principalId": "[parameters('servicePrincipalId')]", "principalType": "ServicePrincipal" }, "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]" ] } ], "outputs": { "dcrId": { "type": "string", "metadata": { "description": "The resource ID of the DCR" }, "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName'))]" }, "dcrImmutableId": { "type": "string", "metadata": { "description": "The immutable ID of the DCR" }, "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), '2024-03-11').immutableId]" }, "logsIngestionEndpoint": { "type": "string", "metadata": { "description": "The logs ingestion endpoint" }, "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dcrName')), '2024-03-11').endpoints.logsIngestion]" }, "streamName": { "type": "string", "metadata": { "description": "The stream name for the DCR" }, "value": "[parameters('streamName')]" } } } }, "dependsOn": [ "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]" ] } ], "outputs": { "workspaceName": { "type": "string", "metadata": { "description": "The name of the Log Analytics workspace" }, "value": "[parameters('workspaceName')]" }, "workspaceId": { "type": "string", "metadata": { "description": "The resource ID of the Log Analytics workspace" }, "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]" }, "customerId": { "type": "string", "metadata": { "description": "The workspace customer ID (used for API calls)" }, "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2025-07-01').customerId]" }, "auditLogsTableName": { "type": "string", "metadata": { "description": "The name of the audit logs custom table" }, "value": "[if(parameters('deployAuditLogsDCR'), variables('auditLogsTableName'), '')]" }, "auditLogsStreamName": { "type": "string", "metadata": { "description": "The stream name for the audit logs DCR" }, "value": "[variables('auditLogsStreamName')]" }, "auditLogsIngestionEndpoint": { "type": "string", "metadata": { "description": "The logs ingestion endpoint URL from the audit logs DCR" }, "value": "[if(parameters('deployAuditLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'auditLogsDcr'), '2025-04-01').outputs.logsIngestionEndpoint.value, '')]" }, "auditLogsDcrImmutableId": { "type": "string", "metadata": { "description": "The immutable ID of the audit logs Data Collection Rule (needed for API calls)" }, "value": "[if(parameters('deployAuditLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'auditLogsDcr'), '2025-04-01').outputs.dcrImmutableId.value, '')]" }, "auditLogsDcrId": { "type": "string", "metadata": { "description": "The resource ID of the audit logs Data Collection Rule" }, "value": "[if(parameters('deployAuditLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'auditLogsDcr'), '2025-04-01').outputs.dcrId.value, '')]" }, "auditLogsDcrName": { "type": "string", "metadata": { "description": "The name of the audit logs Data Collection Rule" }, "value": "[if(parameters('deployAuditLogsDCR'), variables('auditLogsDcrName'), '')]" }, "runbookLogsTableName": { "type": "string", "metadata": { "description": "The name of the runbook logs custom table" }, "value": "[if(parameters('deployRunbookLogsDCR'), variables('runbookLogsTableName'), '')]" }, "runbookLogsStreamName": { "type": "string", "metadata": { "description": "The stream name for the runbook logs DCR" }, "value": "[variables('runbookLogsStreamName')]" }, "runbookLogsIngestionEndpoint": { "type": "string", "metadata": { "description": "The logs ingestion endpoint URL from the runbook logs DCR" }, "value": "[if(parameters('deployRunbookLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'runbookLogsDcr'), '2025-04-01').outputs.logsIngestionEndpoint.value, '')]" }, "runbookLogsDcrImmutableId": { "type": "string", "metadata": { "description": "The immutable ID of the runbook logs Data Collection Rule (needed for API calls)" }, "value": "[if(parameters('deployRunbookLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'runbookLogsDcr'), '2025-04-01').outputs.dcrImmutableId.value, '')]" }, "runbookLogsDcrId": { "type": "string", "metadata": { "description": "The resource ID of the runbook logs Data Collection Rule" }, "value": "[if(parameters('deployRunbookLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'runbookLogsDcr'), '2025-04-01').outputs.dcrId.value, '')]" }, "runbookLogsDcrName": { "type": "string", "metadata": { "description": "The name of the runbook logs Data Collection Rule" }, "value": "[if(parameters('deployRunbookLogsDCR'), variables('runbookLogsDcrName'), '')]" }, "operationalLogsTableName": { "type": "string", "metadata": { "description": "The name of the operational logs custom table" }, "value": "[if(parameters('deployOperationalLogsDCR'), variables('operationalLogsTableName'), '')]" }, "operationalLogsStreamName": { "type": "string", "metadata": { "description": "The stream name for the operational logs DCR" }, "value": "[variables('operationalLogsStreamName')]" }, "operationalLogsIngestionEndpoint": { "type": "string", "metadata": { "description": "The logs ingestion endpoint URL from the operational logs DCR" }, "value": "[if(parameters('deployOperationalLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'operationalLogsDcr'), '2025-04-01').outputs.logsIngestionEndpoint.value, '')]" }, "operationalLogsDcrImmutableId": { "type": "string", "metadata": { "description": "The immutable ID of the operational logs Data Collection Rule (needed for API calls)" }, "value": "[if(parameters('deployOperationalLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'operationalLogsDcr'), '2025-04-01').outputs.dcrImmutableId.value, '')]" }, "operationalLogsDcrId": { "type": "string", "metadata": { "description": "The resource ID of the operational logs Data Collection Rule" }, "value": "[if(parameters('deployOperationalLogsDCR'), reference(resourceId('Microsoft.Resources/deployments', 'operationalLogsDcr'), '2025-04-01').outputs.dcrId.value, '')]" }, "operationalLogsDcrName": { "type": "string", "metadata": { "description": "The name of the operational logs Data Collection Rule" }, "value": "[if(parameters('deployOperationalLogsDCR'), variables('operationalLogsDcrName'), '')]" } } } |