Custom Data Collection Rule for VM Insights and event logging

README.md

Deploy

az deployment group create --resource-group "rg-data" --template-file dcr.bicep --parameters "workspaceName=log-arc-001" "dcrName=dcr-test-001" "workspaceResourceGroupName=rg-arc" "location=westeurope"

dcr.bicep

param workspaceName string
param dcrName string
param location string = resourceGroup().location
param workspaceResourceGroupName string = resourceGroup().name

resource workspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' existing = {
  name: workspaceName
  scope: resourceGroup(workspaceResourceGroupName)
}

resource dcr 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
  properties: {
    description: 'Custom Data collection rule with VM Insights'
    dataSources: {
      windowsEventLogs: [
        {
          streams: [
            'Microsoft-Event'
          ]
          xPathQueries: [
            'Application!*[System[(Level=1)]]'
          ]
          name: 'eventLogsDataSource'
        }
      ]
      performanceCounters: [
        {
          streams: [
            'Microsoft-InsightsMetrics'
          ]
          samplingFrequencyInSeconds: 60
          counterSpecifiers: [
            '\\VmInsights\\DetailedMetrics'
          ]
          name: 'VMInsightsPerfCounters'
        }
      ]
    }
    destinations: {
      logAnalytics: [
        {
          workspaceResourceId: workspace.id
          name: 'workspace'
        }
      ]
    }
    dataFlows: [
      {
        streams: [
          'Microsoft-Event'
        ]
        destinations: [
          'workspace'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-Event'
      }
      {
        streams: [
          'Microsoft-InsightsMetrics'
        ]
        destinations: [
          'workspace'
        ]
      }
    ]
  }
  location: location
  kind: 'Windows'
  name: dcrName
}