The data ingestion API’s have made it really easy to get data into Log Analytics, but they still require a little bit of coding knowledge. Or it used to take a bit of coding knowledge – not anymore! This blog post will give the steps required to make a drop dead simple method to send any data that you want to Log Analytics without having to write any code to do so.
This blog post will cover three major topics:
- How to create the Flow to send data to Log Analytics
- How to run the Flow
Any gotcha’s to be aware of with this approach
Creating the Flow to send data to Log Analytics
To accomplish this we are going to use Microsoft Flow. We are going to create a Flow which receives data via an email and then writes that data into Log Analytics.
We start by creating a new Flow by going to “My Flows” and “Create from Blank”. Then we specify how to trigger this Flow to occur. For this example we can look to either an email from gmail or from outlook. The “To” field needs to be filled out with your correct email address, and the subject needs to contain a unique keyword that the Flow will look for (“FlowJSON” in this case).
Then we add a step to send this data to Log Analytics. We specify that the JSON we need to send to Log Analytics is stored in the email body, and we specify a custom log name which is drawn from the subject. To do this we use a trick that Donnie taught me to remove the original keyword we specified and the space so that the only thing left is the name of the custom log to create.
For example the subject sent in would be “FlowJSON OpenWeatherForecast” and the Custom Log name would be “OpenWeatherForecast”. If we remove “FlowJSON ” from the subject field we are left with only the custom log name “OpenWeatherForecast”.
And that’s all that’s needed to make this happen! Here’s what the final Flow looks like:
Running the Flow
To run the Flow we just need to send an email to the account which we specify which contains a valid subject (FlowJSON <CustomLogName>) and a valid body consisting of the JSON data that you want to send to Log Analytics. Below is a sample email:
Subject: FlowJSON OpenWeatherForecast
For those who were at my sessions at MMS, this is how I “faked a tornado” during the session I co-presented with Donnie on. A success condition of 200 indicates that the data was successfully written into Log Analytics (remember, when writing new Log Analytics custom logs – after the first successful write close all of your browsers and re-open them to see the new data which was written to the custom log).
There are a few gotcha’s to be aware of with this approach:
- The subject needs to be correct – it has to have the correct keyword and it has to have the name of the custom log that you want to write the data to.
- This will only work with Plain Text emails, not with HTML or Rich text emails. If this isn’t set correctly will also mess up the JSON stored in the message body and result in a failure when trying to send the data to Log Analytics.
- Do NOT include signatures in the email – this will mess up the JSON stored in the message body and result in a failure when trying to send the data to Log Analytics.
- If you have Information Classification turned on in Outlook, set it to Public (Wide Open) when sending this email. If this isn’t set correctly (you guessed it) it will also mess up the JSON stored in the message body and result in a failure when trying to send the data to Log Analytics.
Summary: If you are looking for a really easy way to write any data that you want to Log Analytics without having to write any code check out Microsoft Flow!
Thank you to Donnie Taylor for his help on this one, I don’t think I could have made this anywhere near as useful as it is without your help – you rock!