Azure Monitor Log Analytics retention is now configurable by data type
Published date: 08 October, 2019
Data retention in Azure Monitor Log Analytics can now be configured for each data type, rather than only a single retention setting for the entire workspace.
It's easy to configure retention for each data type via simple ARM commands. To check the retention for the data types in your workspace, do a GET on the Tables sub-resource:
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables/SecurityEvent?api-version=2017-04-26-preview
Setting retention is similarly straightforward. For example, to set the retention for SecurityEvents to 730 days:
PUT /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables/SecurityEvent?api-version=2017-04-26-preview {"properties": {"retentionInDays": 730 } }
This new flexibility of setting retention on individual data types can be used to reduce your costs for data retention. For data collected starting in October 2019 (when this feature was released), reducing the retention for some data types can reduce your retention cost over time. For data collected earlier, setting a lower retention for an individual type won’t affect your retention costs.
Learn more and get additional tips on using this feature.