Azure Monitor Custom Log Ingestion
Guides Python agents to send custom logs to Log Analytics through the Logs Ingestion API.
The evidence favors DefaultAzureCredential, allows constraining the production credential chain, and discourages connection strings and API keys, reducing credential exposure. However, it lacks guidance on sensitive log fields, user confirmation before external upload, least-privilege RBAC, explicit data-flow disclosure, and rollback; the silent error-ignoring example also reduces safety, so points are deducted.
The main path covers sync, async, partial failures, and batching, with context-manager guidance. However, the examples are not fully consistent: the document says local DefaultAzureCredential works as-is while using require_envvar=True, the main async example does not close the async credential, and parameter validation, retry boundaries, and diagnosable exception handling are thin. Static calibration therefore keeps this below 10.
The name, description, trigger terms, environment variables, sync/async modes, and primary scenarios are reasonably clear, and sovereign-cloud usage is included. Boundaries are incomplete: non-fit cases, required Azure permissions, network constraints, schema compatibility, and Chinese-language guidance are not stated. The core function depends on Azure service reachability, which is environment-dependent; no mainland-China adaptation evidence is provided.
The skill has YAML metadata, MIT licensing, a version, installation notes, reference files, and concept tables, with generally readable layering. It lacks a changelog, explicit maintenance owner, and clear update path; the references are largely an index or duplicated material, and lifecycle examples are inconsistent, so points are deducted.
It can directly guide installation, log upload, JSON input, partial-failure handling, async use, and sovereign-cloud configuration, covering the core task. It omits resource and permission setup, DCR schema validation, sensitive-data filtering, production retry policy, and ingestion verification, so users still need substantial configuration and review. Static calibration caps this at 7.
The skill contains concrete code and parameters, but no skill-specific committed test suite, real CI coverage, or third-party execution evidence is supplied. Repository-level workflows and harness tests are generic and do not establish correctness of this skill's key paths, so only limited auditable evidence is credited.
- Uploading sends log data to Azure Monitor; before execution, verify that logs contain no credentials, personal data, or other data that must not leave the environment, and validate the DCR schema and RBAC permissions.
- Avoid the silent error-ignoring example; record failures, define retry limits, and confirm whether duplicate uploads are acceptable.
- Reconcile DefaultAzureCredential(require_envvar=True) with the local-development instructions, and explicitly close DefaultAzureCredential in asynchronous code.
What it does & when to use it
This Agent Skill is focused on the Azure Monitor Ingestion SDK for Python and helps send custom logs to an Azure Monitor Log Analytics workspace. It covers synchronous and asynchronous clients, DefaultAzureCredential authentication, Data Collection Endpoints, Data Collection Rules, and DCR stream names. The guidance also includes partial-failure handling, retries, automatic batching, gzip compression, parallel uploads, and Azure Government configuration. It assumes that a Log Analytics workspace, DCE, DCR, and custom table already exist.
It guides an agent to install azure-monitor-ingestion and azure-identity, read the DCE endpoint, DCR immutable ID, stream name, and credential settings from environment variables, create a synchronous or asynchronous LogsIngestionClient, and call upload with structured logs. It also shows how to load logs from JSON, collect failed records through on_error and retry them, ignore upload failures, use DefaultAzureCredential or managed identity, and configure sovereign-cloud endpoints and credential scopes.
- A Python backend developer needs to send structured application logs to a Log Analytics workspace.
- A platform or operations engineer already has a DCE, DCR, and custom table and needs an ingestion script.
- A team handling high-volume logs needs the async client and the SDK’s automatic batching, compression, and parallel upload behavior.
- A service needs to capture partial upload failures and retry only the failed records.
- An Azure Government team needs a sovereign-cloud endpoint and authority configuration for log ingestion.
Pros & cons
- Covers both sync and async Python clients and explicitly addresses deterministic resource cleanup.
- Provides guidance for DefaultAzureCredential, managed identity, and Azure Government.
- Includes partial-failure callbacks, failed-log retries, and an ignore-errors pattern.
- Explains that the SDK automatically splits logs into chunks of 1MB or less, gzip-compresses them, and uploads chunks in parallel.
- It does not create the DCE, DCR, Log Analytics workspace, or custom table.
- Users must prepare the endpoint, rule, stream, and matching log schema in advance.
- The scope is log ingestion; it does not provide Log Analytics query or ingestion-status query code.
- The supplied material does not provide test results specific to this individual skill.
How to install
Install the collection into the selected agent configuration with:
npx skills add microsoft/skills
Choose azure-monitor-ingestion-py in the installation wizard. Install the Python dependencies separately:
pip install azure-monitor-ingestion
pip install azure-identity
The supplied material does not document additional agent-specific manual installation steps.
How to use
Supported trigger phrases include “azure-monitor-ingestion”, “LogsIngestionClient”, “custom logs”, “DCR”, and “Log Analytics”. For example:
“Use azure-monitor-ingestion to write Python code that uploads custom logs to Log Analytics with DefaultAzureCredential, context managers, and failed-log retries.”
Before using the examples, set AZURE_DCE_ENDPOINT, AZURE_DCR_RULE_ID, and AZURE_DCR_STREAM_NAME. When DefaultAzureCredential is used in production, also set AZURE_TOKEN_CREDENTIALS=prod or a specific credential value. Log records must match the DCR schema and include TimeGenerated.