Log Analytics

Overview

We set up Log Analytics workspaces for platform and application logs, with retention and a daily cap that match how you investigate incidents. Tables are limited to the categories you will query, and we write the KQL you need for the first set of questions.

We connect diagnostics from the data services in scope and agree who can read the workspace. If several subscriptions should share one workspace, that is decided up front so logs are not split across three places.

What we deliver

• Workspace with retention, cap, and access for the operations team
• Diagnostic settings for the data services in scope
• Saved KQL for the investigations you already run by hand
• A note on which log categories were left off to control cost

Business benefits

• Pipeline, security, and platform logs can be queried in one workspace
• Retention is a decision, not the portal default
• The first investigations start from a saved query