⭐ [Enhancement]: Introduce Azure Log Analytics Sink

[JerryNixon]

What is it

• Add support for Azure Log Analytics as a telemetry sink
• Align with existing application-insights and future file sink syntax
• Support both shared-key and entra-id authentication modes

Added properties

{
  "runtime": {
    "telemetry": {
      "azure-log-analytics": { ... }
    }
  }
}

properties

"azure-log-analytics": {
  "enabled": true, (bool, default: false)
  "auth": {
    "custom-table-name": "string", (string, required)
    "dcr-immutable-id": "string", (string, required if type == "entra-id")
    "dce-endpoint": "string" (string, required if type == "entra-id")
  },
  "dab-identifier": "DabLogs", (string, default: "DabLogs")
  "flush-interval-seconds": 5 (integer, default: 5)
}

Setting	Meaning	Default
enabled	Enables the sink	false
auth.custom-table-name	Name of Azure Log Analytics Workspace Table	(required)
auth.dcr-immutable-id	DCR ID for entra-id mode	(required)
auth.dce-endpoint	DCE endpoint for entra-id mode	(required)
dab-identifier	Custom name of logs sent to DAB	DabLogs
flush-interval-seconds	Interval between log batch pushes (in seconds)	5

5 is an important default for flush because our containers are often ephemeral.

JSON Schema

Update the DAB JSON schema to support the new azure-log-analytics sink with conditional requirements based on the selected auth type.

Schema structure:

{
  "azure-log-analytics": {
    "type": "object",
    "properties": {
      "enabled": {
        "type": "boolean",
        "default": false
      },
      "auth": {
        "type": "object",
        "properties": {
          "custom-table-name": {
            "type": "string"
          },
          "dcr-immutable-id": {
            "type": "string"
          },
          "dce-endpoint": {
            "type": "string"
          }
        }
      },
      "dab-identifier": {
        "type": "string",
        "default": "DabLogs"
      },
      "flush-interval-seconds": {
        "type": "integer",
        "default": 5
      }
    },
    "required": ["enabled", "auth"]
  }
}

Notes:

• Enforce dab-identifier pattern using:
  "pattern": "^[A-Za-z][A-Za-z0-9_]{0,99}$"

• Default values apply if fields are omitted.

• Add schema definitions under /runtime/telemetry/azure-log-analytics in the main schema structure.

CLI Updates

Add support to dab configure:

1. dab configure --runtime.telemetry.azure-log-analytics.enabled
2. dab configure --runtime.telemetry.azure-log-analytics.auth.custom-table-name
3. dab configure --runtime.telemetry.azure-log-analytics.auth.dcr-immutable-id
4. dab configure --runtime.telemetry.azure-log-analytics.auth.dce-endpoint
5. dab configure --runtime.telemetry.azure-log-analytics.dab-identifier
6. dab configure --runtime.telemetry.azure-log-analytics.flush-interval-seconds

Considerations

1. Respect log-level filters from global config
2. Logs will duplicate across sinks when explicitly enabled
3. Must handle retries and backoff for ingestion failures (should be part of the built-in library)

Errors

1. If enabled is true but required fields are missing, fail to start and log error
2. If ingestion fails, retry up to 3 times with exponential backoff, then log and continue
3. If invalid dab-identifier is used (must match [A-Za-z][A-Za-z0-9_]{0,99}), fail to start

Flow

sequenceDiagram
  participant Engine
  participant Config
  participant LogAnalytics
  participant TelemetrySink

  Engine->>Config: Load config
  Config-->>Engine: Config object

  Engine->>TelemetrySink: Initialize Log Analytics sink
  TelemetrySink->>LogAnalytics: Authenticate using auth.type
  TelemetrySink->>LogAnalytics: Send batched logs every 5 seconds

Loading

Comments for the future docs

If running in a container:

• Recommend storing credentials via @env() or @akv()
• For entra-id, use system-assigned or user-assigned managed identity
• Logs sent over HTTPS, no persistent file storage required

[Aniruddh25]

@JerryNixon -
if auth.type has a default value, why is it required?
if enabled has a default value, why is it required under "azure-log-analytics"?

[JerryNixon]

if auth.type has a default value, why is it required?
if enabled has a default value, why is it required under "azure-log-analytics"?

Great point. Defaulted items should NOT be required.