How to configure a new DCR to ingest to an existing Custom Log table?

Question

Hi All,

I am currently migrating existing syslog logfeeds running over Logstash pipelines with the "microsoft-logstash-output-azure-loganalytics" output module to Logstash pipelines with the "microsoft-sentinel-log-analytics-logstash-output-plugin" output module with DCR. I would like to ingest the migrated flow into the existing Custom Log table, but I did not found any solution so far in the Azure WebGUI. Is there a way to accomplish this? Possible by the web shell?

Thanks for sharing your experience.

Regards,

Nico

Answer 1

Hello Callens Nico,

To ingest the migrated flow into an existing custom Log Table, you can follow the guidance given on this doc https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/README.md

In case you are still having challenges with the plug-in please open a support ticket here - https://ms.portal.azure.com/#create/Microsoft.Support As the service type select- "Azure Sentinel"

I hope this helps to answer your question.
If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.