topic Re: Custom Log ingestion in Log Analytics

Custom Log ingestion

Shal — Fri, 09 May 2025 15:53:33 GMT

Hi Team,

I need to add below custom log path for log monitoring where file name will be in the yyyy-mm-dd.log format and we need only log levels Error from the log.

Path Location	File Name	Error Code, String, pattern match
D:\logs\xxx.yyy	YYYY-MM-DD.log	ERROR

As per documentation, added the log in custom log path as d:\Logs\xxx.yy\*.logs under host>logmonitoring .

How can we ensure it is picking the exact file?

Where can I add the filter condition?

Can someone give the right steps on how to add the custom logs with filter conditions?

Thanks

Re: Custom Log ingestion

AntonPineiro — Mon, 14 Apr 2025 10:03:42 GMT

Hi,

When you add a custom path, if should appears when you are creating log ingestion rule.

Best regards

Re: Custom Log ingestion

Mizső — Tue, 15 Apr 2025 08:01:10 GMT

Hi @Shal

You can easily ingest custom logs.

Option 1.

Option 2.

As @AntonPineiro mentioned, you can ingest the custom log source and then filter it.

You can check the results in the Logs at managed and saas also.

I hope it helps.

Best regards,

János

Re: Custom Log ingestion

Shal — Wed, 16 Apr 2025 12:30:08 GMT

Thankyou @Mizső .The detailed explanation is very helpful.

1)I can see option 1 is already enabled in my environment .So Can I also have both Option 1 and Option 2?

2)I have added ingestion rule as Log source - is any of custom log and

log level is any of ERROR.

But it was showing for WARN log levels also.

Then I tried adding processing rule to filterout WARN, and it was showing only for ERROR log levels. But this rule will apply to all logs irrespective of host.

Also when am giving path as D:\logs\xxx\Errors\#.log I can see the filename is showing as today's date like 2025-04-16. However it is not showing the older files (like yesterday's or other dates even when we take custom date picker).

Any recommendations do you have?

Thanks!

Re: Custom Log ingestion

Mizső — Tue, 22 Apr 2025 08:01:23 GMT

Hi @Shal,

I prefer the option 2.

Could you please share your option 2 settings. Only ERROR level logs should be ingested.

Regarding date issue, only the new log lines will be ingested after the settings. Some days later you should see the logs in the same source D:\logs\xxx\Errors\#.log

Best regards,

János

Re: Custom Log ingestion

Shal — Tue, 29 Apr 2025 07:04:32 GMT

Thanks Janos.

I disabled default option -( option 1 )and enabled option 2 . I removed processing rule as well.

option 2- create rule for each log source and add condition in that rule.

It is working with that setting.

Thanks for your guidance.