Azure CustomLog程序化配置求助：模板/az cli配置失败，API属性缺失

你遇到的问题其实是因为Azure的自定义日志配置方式已经更新了——旧的Microsoft.OperationalInsights/workspaces/datasources API确实不再是推荐的配置路径，而且门户里的旧配置入口也已经迁移到Data Collection Rules (DCR) 体系下了。下面给你几个可靠的程序化配置方法，覆盖CLI、ARM模板和REST API：

一、Azure CLI配置流程 #

这是最直观的方式，适合快速测试或自动化脚本：

1. 创建Data Collection Rule (DCR)
   下面的示例会创建一个收集Windows本地自定义日志的DCR，指定日志文件路径、格式，并将数据发送到Log Analytics工作区：

   az monitor data-collection rule create \
     --name "MyCustomLogDCR" \
     --resource-group "your-rg-name" \
     --location "eastus" \
     --data-sources '{
       "customLogs": [
         {
           "name": "WindowsAppLogs",
           "streams": ["Custom-MyAppLog"],
           "filePatterns": ["C:\\MyAppLogs\\*.log"],
           "format": {
             "type": "text",
             "textFormat": {
               "separator": "space",
               "firstLineContainsHeaders": false
             }
           }
         }
       ]
     }' \
     --destinations '{
       "logAnalytics": [
         {
           "name": "LAWorkspaceDest",
           "workspaceResourceId": "/subscriptions/your-sub-id/resourceGroups/your-rg-name/providers/Microsoft.OperationalInsights/workspaces/your-law-name"
         }
       ]
     }' \
     --data-flows '[
       {
         "streams": ["Custom-MyAppLog"],
         "destinations": ["LAWorkspaceDest"]
       }
     ]'
   

2. 关联DCR到目标资源
   如果是收集虚拟机上的日志，需要安装Azure Monitor Agent并关联DCR：

   # 安装Windows版Azure Monitor Agent
   az vm extension set \
     --name AzureMonitorWindowsAgent \
     --publisher Microsoft.Azure.Monitor \
     --vm-name "your-vm-name" \
     --resource-group "your-rg-name"
   
   # 关联DCR到VM
   az monitor data-collection rule association create \
     --name "VM-DCR-Assoc" \
     --resource-group "your-rg-name" \
     --rule-name "MyCustomLogDCR" \
     --resource "/subscriptions/your-sub-id/resourceGroups/your-rg-name/providers/Microsoft.Compute/virtualMachines/your-vm-name"
   

二、ARM模板配置 #

适合基础设施即代码（IaC）场景，下面是一个收集Azure Blob存储中自定义日志的模板示例：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "dcrName": {
      "type": "string",
      "defaultValue": "BlobCustomLogDCR"
    },
    "lawResourceId": {
      "type": "string"
    },
    "storageAccountName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Insights/dataCollectionRules",
      "name": "[parameters('dcrName')]",
      "apiVersion": "2021-09-01-preview",
      "location": "[resourceGroup().location]",
      "properties": {
        "dataSources": {
          "customLogs": [
            {
              "name": "BlobStorageLogs",
              "streams": ["Custom-BlobAppLog"],
              "storageAccounts": [
                {
                  "accountName": "[parameters('storageAccountName')]",
                  "accountKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2021-04-01').keys[0].value]",
                  "containerName": "app-logs",
                  "filePatterns": ["prod/*.json"]
                }
              ],
              "format": {
                "type": "json"
              }
            }
          ]
        },
        "destinations": {
          "logAnalytics": [
            {
              "name": "LAWorkspace",
              "workspaceResourceId": "[parameters('lawResourceId')]"
            }
          ]
        },
        "dataFlows": [
          {
            "streams": ["Custom-BlobAppLog"],
            "destinations": ["LAWorkspace"]
          }
        ]
      }
    }
  ]
}

三、REST API配置 #

适合自定义自动化集成，调用Microsoft.Insights/dataCollectionRules API来创建DCR：

请求信息 #

• 方法: POST
• URL: https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}?api-version=2021-09-01-preview

请求体示例（收集Linux本地日志） #

{
  "location": "westus",
  "properties": {
    "dataSources": {
      "customLogs": [
        {
          "name": "LinuxAppLogs",
          "streams": ["Custom-LinuxAppLog"],
          "filePatterns": ["/var/log/my-app/*.log"],
          "format": {
            "type": "text",
            "textFormat": {
              "separator": "comma",
              "firstLineContainsHeaders": true
            }
          }
        }
      ]
    },
    "destinations": {
      "logAnalytics": [
        {
          "name": "LAWorkspace",
          "workspaceResourceId": "/subscriptions/your-sub-id/resourceGroups/your-rg-name/providers/Microsoft.OperationalInsights/workspaces/your-law-name"
        }
      ]
    },
    "dataFlows": [
      {
        "streams": ["Custom-LinuxAppLog"],
        "destinations": ["LAWorkspace"]
      }
    ]
  }
}

关键说明 #

• 旧的CustomLog数据源API已被弃用，现在所有自定义日志收集都基于DCR，它支持更灵活的格式配置（文本、JSON、CSV）、字段提取和多数据源类型。
• 门户中配置自定义日志的入口现在在Log Analytics工作区的Data Collection Rules菜单下，你可以在这里可视化配置后导出模板或CLI命令，方便程序化复用。
• 确保目标资源上安装了Azure Monitor Agent（AMA），这是当前唯一支持DCR的日志收集代理，旧的Log Analytics Agent（MMA）不再推荐使用。

内容的提问来源于stack exchange，提问作者BlindSniper