Unable to set Interactive retention and Total retention period for Log Analytics Workspace table

[EAR009]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.2

AzureRM Provider Version

3.108.0

Affected Resource(s)/Data Source(s)

azurerm_log_analytics_workspace, azurerm_log_analytics_workspace_table

Terraform Configuration Files

To reduce the cost on Log Analytics Workspace to store logs, I am trying to set Interactive retention and Total retention period for Log Analytics Workspace table as per below link.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?tabs=portal-3%2Cportal-1%2Cportal-2#set-retention-and-archive-policy-by-table

Unfortunately, it is not supported seems. Kindly analyze the requirement and do the needful.

Debug Output/Panic Output

NA

Expected Behaviour

I should be able to set Interactive retention and Total retention period for ant tables in the Log Analytics Workspace

Actual Behaviour

No response

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[webstean]

Use the following
`resource "azurerm_log_analytics_workspace" "shared_log_analytics" {

name = "name"
location = "location"
resource_group_name = "resource_group_name"
sku = "PerGB2018"

30 is the minimum, 730 is the maximum

retention_in_days = 30

daily quota - help if log storm happens (limit logging to 500Mb per day)

daily_quota_gb = 0.5
immediate_data_purge_on_30_days_enabled = true

tags = "tags"
}`
Adding a daily quota, can really help with misconfiguration not costing you lots of money.

To reduce cost further, you can convert some tables from analytics to basic with `locals {

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/basic-logs-configure

LAW tables are tied to solution creation, if a table is missing, its because its solutions has NOT been installed.

basic_logs_support = toset([
"AADDomainServicesDNSAuditsGeneral",
"AADDomainServicesDNSAuditsDynamicUpdates",
"AADServicePrincipalSignInLogs",
"ACRConnectedClientList",
"ACSCallAutomationIncomingOperations",
"ACSCallAutomationMediaSummary",
"ACSCallClientMediaStatsTimeSeries",
"ACSCallClientOperations",
"ACSCallRecordingIncomingOperations",
"ACSCallRecordingSummary",
"ACSCallSummary",
"ACSJobRouterIncomingOperations",
"AFSAuditLogs",
"ACSRoomsIncomingOperations",
## "Application Gateways",
"AGWAccessLogs",
"AGWPerformanceLogs",
"AGWFirewallLogs",
"AGCAccessLogs",
"AZKVAuditLogs",
"AZKVPolicyEvaluationDetailsLogs",
"AKSAudit",
"AKSAuditAdmin",
"AKSControlPlane",
"AppEnvSpringAppConsoleLogs",
"ApiManagementGatewayLogs",
"ApiManagementWebSocketConnectionLogs",
"AZMSApplicationMetricLogs",
"AZMSOperationalLogs",
"AZMSRunTimeAuditLogs",
## "AZMSVNetConnectionEvents",
"AZMSHybridConnectionsEvents",
"ASCAuditLogs",
"AVNMNetworkGroupMembershipChange",
"AVNMRuleCollectionChange",
"ASCDeviceEvents",
"ArcK8sAudit",
"ArcK8sAuditAdmin",
"ArcK8sControlPlane",
"AHDSMedTechDiagnosticLogs",
"AHDSDicomDiagnosticLogs",
"AHDSDicomAuditLogs",
"AMSLiveEventOperations",
"AMSKeyDeliveryRequests",
"AMSMediaAccountHealth",
"AMSStreamingEndpointRequests",
"AOIDatabaseQuery",
"AOIDigestion",
"AOIStorage",
"AVNMConnectivityConfigurationChange",
"AVNMIPAMPoolAllocationChange",
"AZMSArchiveLogs",
"AZMSAutoscaleLogs",
"AZMSCustomerManagedKeyUserLogs",
"AZMSKafkaCoordinatorLogs",
"AZMSKafkaUserErrorLogs",
"AZFWFlowTrace",
"AzureMetricsV2",
### "CBMSecurityLogs",
"CCFApplicationLogs",
"ChaosStudioExperimentEventLogs",
"CHSMManagementAuditLogs",
"ContainerAppConsoleLogs",
"ContainerLogV2",
"DataTransferOperations",
"DevCenterDiagnosticLogs",
"DevCenterResourceOperationLogs",
"DevCenterBillingEventLogs",
"DNSQueryLogs",
"NCBMSystemLogs",
"NCCKubernetesLogs",
"NCCVMOrchestrationLogs",
"NCSStorageLogs",
"NCSStorageAlerts",
"MNFDeviceUpdates",
"MNFSystemStateMessageUpdates",
"OEPDataplaneLogs",
"REDConnectionEvents",
## "SecurityAttackPathData",
"StorageBlobLogs",
"StorageFileLogs",
"StorageQueueLogs",
"StorageTableLogs",
## "SynapseSqlPoolExecRequests",
## "SynapseSqlPoolRequestSteps",
## "SynapseSqlPoolDmsWorkers",
## "SynapseSqlPoolSqlRequests",
## "SynapseSqlPoolRequestSteps",
## "SynapseSqlPoolExecRequests",
## "SynapseSqlPoolDmsWorkers",
## "SynapseSqlPoolWaits",
"StorageMoverJobRunLogs",
"StorageMoverCopyLogsFailed",
"StorageMoverCopyLogsTransferred",
## "VCoreMongoRequests",
])
}

resource "azurerm_log_analytics_workspace_table" "basic" {
for_each = local.basic_logs_support

the table must exist, otherwise the plan will fail

name = each.key
workspace_id = azurerm_log_analytics_workspace.xxxxxx.id
plan = "Basic"

The retention_in_days must be 30, when plan is Basic

total_retention_in_days = 30
}
`
Note: That you loose some capablities moving from analytics to basic, but most of the time, that shouldn't be an issue.

[ziyeqf]

Hi @EAR009, thanks for opening the issue.

the azurerm_log_analytics_workspace_table resource has supported retention_in_days and total_retention_in_days since v3.91, could you please upgrade you azurerm provider version and try again?( reference )

Thanks.

[EAR009]

Thanks for the update. I think the options mentioned on below Microsoft link is handled with different naming on terraform syntax.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?tabs=portal-3%2Cportal-1%2Cportal-2#set-retention-and-archive-policy-by-table

1. I am testing the various options, but it would really make sense if naming convention on terraform syntax inline with the portal (also on Microsoft link which is same as in portal).

2. And, Is there a possibility to set retention_in_days to less than 30 days?