locked
Changing time in azure log analytics RRS feed

  • Question

  • In 'Azure log Analytics' logs are saved all day. Is there any way to change the time of saving? I mean changing time so that logs are saved for example between 6:00 AM to 9:00 PM? I'm only interested to logs between these times.

    It would be great if you send an screenshot. Thank you!


    • Edited by Niki365 Wednesday, August 19, 2020 11:48 AM
    Wednesday, August 19, 2020 11:48 AM

All replies

  • Log Analytics Dedicated Clusters are collections of workspaces into a single managed Azure Data Explorer cluster to support advanced scenarios such as Customer-Managed Keys. Log Analytics Dedicated Clusters support only a Capacity Reservation pricing model starting at 1000 GB/day with a 25% discount compared to Pay-As-You-Go pricing. Any usage above the reservation level will be billed at the Pay-As-You-Go rate. The cluster Capacity Reservation has a 31-day commitment period after the reservation level is increased. During the commitment period the capacity reservation level cannot be reduced, but it can be increased at any time. Learn more about creating a Log Analytics Clusters and associating workspaces to it.

    The cluster capacity reservation level is configured via programatically with Azure Resource Manager using the Capacity parameter under Sku. The Capacity is specified in units of GB and can have values of 1000 GB/day or more in increments of 100 GB/day. This is detailed at Azure Monitor customer-managed key. If your cluster needs a reservation above 2000 GB/day contact us at LAIngestionRate@microsoft.com.

    There are two modes of billing for usage on a cluster. These can be specified by the billingType parameter when configuring your cluster. The two modes are:

    Cluster: in this case (which is the default), billing for ingested data is done at the cluster level. The ingested data quantities from each workspace associated to a cluster is aggregated to calculate the daily bill for the cluster. Note that per-node allocations from Azure Security Center are applied at the workspace level prior to this aggregation of aggregated data across all workspaces in the cluster.

    Workspaces: the Capacity Reservation costs for your Cluster are attributed proportionately to the workspaces in the Cluster (after accounting for per-node allocations from Azure Security Center for each workspace.) If the total data volume ingested into a workspace for a day is less than the Capacity Reservation, then each workspace is billed for its ingested data at the effective per-GB Capacity Reservation rate by billing them a fraction of the Capacity Reservation, and the unused part of the Capacity Reservation is billed to the cluster resource. If the total data volume ingested into a workspace for a day is more than the Capacity Reservation, then each workspace is billed for a fraction of the Capacity Reservation based on it’s fraction of the ingested data that day, and each workspace for a fraction of the ingested data above the Capacity Reservation. There is nothing billed to the cluster resource if the total data volume ingested into a workspace for a day is over the Capacity Reservation.

    In cluster billing options, data retention is billed at the workspace level. Note that cluster billing starts when the cluster is created, regardless of whether workspaces have been associated to the cluster. Also, note that workspaces associated to a cluster no longer have a pricing tier.
    Wednesday, August 19, 2020 2:14 PM