Terraform Azurerm - Data Export Rule

Question

My query is related to azurerm_log_analytics_data_export_rule. I have created Log Analytics Workspace and Eventhub in portal followed all the steps in below link. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/log_analytics_data_export_rule

Both Terraform Plan and Apply are successful. But the expected tables are not created in Eventhub. For example (as per above link) “Heartbeat” table is not created Eventhub after export_rule created. The below Microsoft documentation mentions that the tables will be automatically created in EH or Storage account once export rule creation successful.

https://docs.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export?tabs=portal

Will be helpful if I get some info on this rule.

Answer 1

The Hashicrop template you are following will create new resource group, storage account, log analytics workspace & a export rule.

• Since the above terraform template is creating new environment & there will be no heart beat logs present by default so that is reason why there were no heart beat logs container was created.
• When we have tested in our environment, exporting heart beat logs of log analytics workspace data to storage account it took nearly 30 minutes to get the data to be reflected in our storage account.

Data completeness

Data export will continue to retry sending data for up to 30 minutes in the event that the destination is unavailable. If it's still unavailable after 30 minutes then data will be discarded until the destination becomes available.

Answer 2

provider "azurerm" {
  features{}
}

resource "azurerm_resource_group" "data_export_resource_group" {
  name     = "test_data_export_rg"
  location = "centralus"
}

resource "azurerm_log_analytics_workspace" "data_export_log_analytics_workspace" {
  name                = "testdataexportlaw"
  location            = azurerm_resource_group.data_export_resource_group.location
  resource_group_name = azurerm_resource_group.data_export_resource_group.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
}

resource "azurerm_storage_account" "data_export_azurerm_storage_account" {
  name                     = "testdataexportazurermsa"
  resource_group_name      = azurerm_resource_group.data_export_resource_group.name
  location                 = azurerm_resource_group.data_export_resource_group.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_eventhub_namespace" "data_export_azurerm_eventhub_namespace" {
  name                = "testdataexportehnamespace"
  location            = azurerm_resource_group.data_export_resource_group.location
  resource_group_name = azurerm_resource_group.data_export_resource_group.name
  sku                 = "Standard"
  capacity            = 1

  tags = {
    environment = "Production"
  }
}

resource "azurerm_eventhub" "data_export_eventhub" {
  name                = "testdataexporteh1"
  namespace_name      = azurerm_eventhub_namespace.data_export_azurerm_eventhub_namespace.name
  resource_group_name = azurerm_resource_group.data_export_resource_group.name
  partition_count     = 2
  message_retention   = 1
}

```
resource "azurerm_log_analytics_data_export_rule" "example" {
  name                    = "testdataExport1"
  resource_group_name     = azurerm_resource_group.data_export_resource_group.name
  workspace_resource_id   = azurerm_log_analytics_workspace.data_export_log_analytics_workspace.id
  destination_resource_id = azurerm_eventhub.data_export_eventhub.id
  table_names             = ["Usage","StorageBlobLogs"]
  enabled                 = true
} 
```