Hi Does anyone know a way to automate sending logs to a storage account, I can send the data to log analytics workspace, but also need to have a policy set that keeps logs for 200 days in a storage account?

Thanks in advance.

  • What service are the logs from? – Sam Cogan Nov 18 at 10:08
  • @SamCogan hi Sam these would be all logs that are stored in the workspace, we have a requirement to save logs for 180 days and I have a policy which sends the logs to the workspace but need to save them to storage account for long term retention – Norrin Rad Nov 18 at 11:47
  • the reason I ask is that it is fairly easy to send logs to storage accounts from the actual resource creating the logs, however exporting the logs from log analytics to storage is more difficult. Is configuring this at the resource an option? – Sam Cogan Nov 18 at 11:49
  • Also, are you aware you can extend the log analytics retention to 2 years? Would this be enough? – Sam Cogan Nov 18 at 11:49
  • I was thinking that (using log analytics) but wouldn’t it be cheaper to use a storage account? I think they can be configured at the resource level, but need an automated process, ideally a policy – Norrin Rad Nov 18 at 11:53

There isn't a built in way to export data from Log Analytics to a storage account, so if you want to do this you are going to need to run a script on regular basis to export the data. You could look at using an Azure Function or Azure Automation job to do this. There are a number of examples online about how to do this.

The two other options you have are:

  1. Increase the retention of your LA workspace - yes this will be more expensive than storage, but you will need to balance that against the additional cost of the automation or function to do this, and managing it
  2. Configure export to storage at the resource level. This could be done with an Azure policy. You could create a policy that configures both Log Analytics and Storage as a destination for the logs.
  • thanks sam, I’ll try and configure the policy. Thanks 👍 – Norrin Rad Nov 18 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.