Microsoft’s latest guide details how to reduce Azure Log Analytics ingestion costs by leveraging Data Collection Rule (DCR) transformations to split high-volume logs into multiple tables and route verbose, low-priority logs to the cost-effective Auxiliary tier.
Key Highlights:
Identify candidate logs
- Review existing tables (e.g., Syslog) to find logs that can be stored in Auxiliary tier without impacting operations.
Create DCR-based custom tables
- Use a PowerShell script to duplicate the schema of the original table.
Implement transformation logic
- Configure DCR to route only specific log types (e.g., “Informational” Syslog entries) to the Auxiliary table while keeping critical logs in the main table.
Set retention policies
- Define retention for Auxiliary tables during creation for cost and compliance balance.
This method can yield significant savings while maintaining necessary logs for auditing and compliance.