The left table shows ingestion costs for all identifiable resources, i.e., resources with a non-empty _ResourceId column. The Tag Value column presents the value of the desired tag associated to the logs-emitting resource. Once you finish setting the parameters, the Workbook will scan the selected workspaces and present a couple of tables like the ones below. Next, select the desired tag for cost allocation by setting the Tag Name parameter. Therefore, as a rule of thumb, start small and progressively increase the scope of the report.įirst thing, you must adjust the Ingestion Price parameter according to your Azure price sheet and the Azure region of the Log Analytics workspaces in scope. Needless to say, the larger the Azure environment and the larger the logs time range, the longer it takes to generate the results. The Log Analytics Ingestion Usage by Tag Workbook puts into practice the rationale I described above, by scanning all the Log Analytics workspace logs and correlating them with Azure tags through the respective Azure resource Id. Log Analytics Ingestion Usage by Tag Workbook The next section describes an Azure Monitor Workbook that does this plumbing. With all this set up, we “just” have to correlate Azure Monitor logs with resource tags. If you agree with me, then you just need to ensure all your Azure and Azure Arc resources are tagged according to your cost allocation needs, which is one of the fundamental practices of cost management in Azure. When speaking of logs cost allocation, a typical and most of the time acceptable reasoning should be to allocate the logs costs to the resources emitting those logs. For example, Key Vault audit logs or Azure Firewall network event logs also come with a resource identifier. This is also true for other Azure platform services using Diagnostic Settings to export their logs to Log Analytics. For example, a Virtual Machine running the Azure Monitor agent which is collecting Syslog events will send its logs to the Syslog table in a specific Log Analytics workspace and all its logs will identify the Virtual Machine through the _ResourceId column. Most of the billable Azure Monitor logs come with a _ResourceId column identifying the Azure or Azure Arc resource who was responsible for emitting the logs. The keys to allocate Log Analytics ingestion costs For more details about Azure Monitor Logs pricing, visit the pricing page. Other cost factors such as Basic logs ingestion, log retention beyond 31 days or Basic Logs queries are not included but can follow a strategy like the one described here. Important: this article describes how to allocate Analytics ingestion costs only. What I am going to describe next is how to do it based on the resource tags. The question this article answers is: how can we sort out which logs belong to which cost center in a simple manner? My colleague Gabrielli recently described the logic behind cost allocation by subscription, resource group or resource. This is especially relevant for customers who centralize as much as possible their Log Analytics workspaces, following Microsoft’s recommended best practices. Consequently, Azure Monitor Logs has also become an important cost driver for many Azure customers and being able to allocate or split those costs across the right cost centers in the organization is a pressing need most customers have. It supports such a vast array of Microsoft cloud services that it has become one of the most used Azure services for all sorts of customers. Azure Monitor Logs, also known as Log Analytics, is a fundamental tool for monitoring and reporting on your Azure, multi-cloud, and hybrid resources.
0 Comments
Leave a Reply. |