Table Level Data Retention

Managing Data Retention settings on a table level, rather than a workspace setting can be useful in scenarios where we want to control the number of days logs are stored in the Log Analytics Workspace.

Until the official provider is supported in Terraform, we are using the AzApi resource for this capability. Please Note: The AzApi resource, has some known issues, wrt. the way resource updates and deletions are handled within Terraform state.

Getting Started

To configure data retention on a table level, follow these steps:

1. Switch to the Azure Log analytics table directory. bash cd azure/<ENVIRONMENT>/resource-groups/security-log-analytics/data-stores/azure-log-analytics-table-retention 2. Open the config file, config.hcl. Here we need to modify the variable, tables. 3. For the list of supported attributes for the tables variable, refer the Microsoft documentation. ## Conclusion This module can be used to manage table level data retention in Log Analytics Workspace. The module allows you to specify the retention period for each table in your workspace. The module also supports archiving data, which can be useful for compliance or historical purposes.