ARM Template for Azure Monitor Logs - Table: MyCustomTable (2025-08-13 10:48:29)

azure-monitor-logs-MyCustomTable-1755074909.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "variables": {
    "tableName": "MyCustomTable",
    "servicePrincipalId": "485118a1-43ff-4d5f-8f49-17589dd53fde",
    "tableRetentionDays": 30,
    "workspaceName": "dev-us1-m1",
    "location": "[resourceGroup().location]",
    "dceName": "[concat(variables('tableName'), '-dce')]",
    "dcrName": "[concat(variables('tableName'), '-dcr')]",
    "streamName": "[concat('Custom-', variables('tableName'))]",
    "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('workspaceName'))]",
    "dceResourceId": "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]",
    "dcrResourceId": "[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]",
    "customTableName": "[variables('tableName')]",
    "monitoringMetricsPublisherRoleId": "3913510d-42f4-4e42-8a64-420c390055eb",
    "monitoringContributorRoleId": "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
    "logAnalyticsContributorRoleId": "92aaf0da-9dab-42b6-94a3-d43ce8d16293",
    "dceRoleAssignmentId1": "[guid(variables('dceResourceId'), variables('servicePrincipalId'), variables('monitoringMetricsPublisherRoleId'), 'dce-metrics')]",
    "dceRoleAssignmentId2": "[guid(variables('dceResourceId'), variables('servicePrincipalId'), variables('monitoringContributorRoleId'), 'dce-contributor')]",
    "dcrRoleAssignmentId1": "[guid(variables('dcrResourceId'), variables('servicePrincipalId'), variables('monitoringMetricsPublisherRoleId'), 'dcr-metrics')]",
    "dcrRoleAssignmentId2": "[guid(variables('dcrResourceId'), variables('servicePrincipalId'), variables('monitoringContributorRoleId'), 'dcr-contributor')]",
    "workspaceRoleAssignmentId": "[guid(variables('workspaceResourceId'), variables('servicePrincipalId'), variables('logAnalyticsContributorRoleId'), 'workspace-contributor')]"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2022-10-01",
      "name": "[concat(variables('workspaceName'), '/', variables('tableName'), '_CL')]",
      "properties": {
        "totalRetentionInDays": "[variables('tableRetentionDays')]",
        "plan": "Analytics",
        "schema": {
          "name": "[concat(variables('tableName'), '_CL')]",
          "columns": [
            {
              "name": "TimeGenerated",
              "type": "datetime"
            },
            {
              "name": "RawData",
              "type": "string"
            }
          ]
        }
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionEndpoints",
      "apiVersion": "2022-06-01",
      "name": "[variables('dceName')]",
      "location": "[variables('location')]",
      "properties": {
        "networkAcls": {
          "publicNetworkAccess": "Enabled"
        }
      }
    },

    {
      "type": "Microsoft.Insights/dataCollectionRules",
      "apiVersion": "2022-06-01",
      "name": "[variables('dcrName')]",
      "location": "[variables('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces/tables', variables('workspaceName'), concat(variables('tableName'), '_CL'))]"
      ],
      "properties": {
        "dataCollectionEndpointId": "[variables('dceResourceId')]",
        "streamDeclarations": {
          "[variables('streamName')]": {
            "columns": [
              {
                "name": "TimeGenerated",
                "type": "datetime"
              },
              {
                "name": "RawData",
                "type": "string"
              }
            ]
          }
        },
        "dataSources": {},
        "destinations": {
          "logAnalytics": [
            {
              "name": "loganalytics-dest",
              "workspaceResourceId": "[variables('workspaceResourceId')]"
            }
          ]
        },
        "dataFlows": [
          {
            "streams": [
              "[variables('streamName')]"
            ],
            "destinations": [
              "loganalytics-dest"
            ],
            "transformKql": "source | project TimeGenerated, RawData",
            "outputStream": "[concat('Custom-', variables('tableName'), '_CL')]"
          }
        ]
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionEndpoints/providers/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[concat(variables('dceName'), '/Microsoft.Authorization/', variables('dceRoleAssignmentId1'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringMetricsPublisherRoleId'))]",
        "principalId": "[variables('servicePrincipalId')]"
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionEndpoints/providers/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[concat(variables('dceName'), '/Microsoft.Authorization/', variables('dceRoleAssignmentId2'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringContributorRoleId'))]",
        "principalId": "[variables('servicePrincipalId')]"
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionRules/providers/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[concat(variables('dcrName'), '/Microsoft.Authorization/', variables('dcrRoleAssignmentId1'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringMetricsPublisherRoleId'))]",
        "principalId": "[variables('servicePrincipalId')]"
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionRules/providers/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[concat(variables('dcrName'), '/Microsoft.Authorization/', variables('dcrRoleAssignmentId2'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringContributorRoleId'))]",
        "principalId": "[variables('servicePrincipalId')]"
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[concat('dev-us1-m1', '/Microsoft.Authorization/', variables('workspaceRoleAssignmentId'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('logAnalyticsContributorRoleId'))]",
        "principalId": "[variables('servicePrincipalId')]"
      }
    }
  ]
}