أمثلة طلب واجهة برمجة التطبيقات لإنشاء قواعد تجميع البيانات (DCRs)
تقدم هذه المقالة بعض الأمثلة على طلبات واجهة برمجة التطبيقات والاستجابات لإنشاء قواعد تجميع البيانات (DCRs) وارتباطات DCR (DCRAs) لاستخدامها مع عامل Azure Monitor (AMA).
Syslog/CEF
الأمثلة التالية هي ل DCRs باستخدام AMA لجمع رسائل Syslog وCEF.
Syslog/CEF DCR
هذه الأمثلة هي لطلب واجهة برمجة التطبيقات والاستجابة لإنشاء DCR.
عنوان URL لطلب إنشاء Syslog/CEF DCR
مثال:
PUT https://management.azure.com/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01?api-version=2022-06-01
نص طلب إنشاء Syslog/CEF DCR
فيما يلي مثال على طلب إنشاء DCR. لكل دفق مصدر بيانات — يمكن أن يكون لديك العديد في DCR واحد — أضف قسما فرعيا جديدا ضمن "syslog"
في "dataSources"
المقطع وقم بتعيين قيمة "streams"
الحقل وفقا لمصدر الرسائل التي تريد استيعابها:
مصدر السجل | "streams" قيمة الحقل |
---|---|
Syslog | "Microsoft-Syslog" |
CEF | "Microsoft-CommonSecurityLog" |
Cisco ASA | "Microsoft-CiscoAsa" |
راجع مثال أقسام تدفقات متعددة في نموذج التعليمات البرمجية التالي:
{
"location": "centralus",
"kind": "Linux",
"properties": {
"dataSources": {
"syslog": [
{
"name": "localsSyslog",
"streams": [
"Microsoft-Syslog"
],
"facilityNames": [
"auth",
"local0",
"local1",
"local2",
"local3",
"syslog"
],
"logLevels": [
"Critical",
"Alert",
"Emergency"
]
},
{
"name": "authprivSyslog",
"streams": [
"Microsoft-Syslog"
],
"facilityNames": [
"authpriv"
],
"logLevels": [
"Error",
"Alert",
"Critical",
"Emergency"
]
}
]
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/Contoso",
"workspaceId": "11111111-2222-3333-4444-555555555555",
"name": "DataCollectionEvent"
}
]
},
"dataFlows": [
{
"streams": [
"Microsoft-Syslog"
],
"destinations": [
"DataCollectionEvent"
]
}
]
}
}
استجابة إنشاء Syslog/CEF DCR
إليك الاستجابة التي يجب أن تتلقاها وفقا لطلب العينة أعلاه:
{
"properties": {
"immutableId": "dcr-0123456789abcdef0123456789abcdef",
"dataSources": {
"syslog": [
{
"streams": [
"Microsoft-Syslog"
],
"facilityNames": [
"auth",
"local0",
"local1",
"local2",
"local3",
"syslog"
],
"logLevels": [
"Critical",
"Alert",
"Emergency"
],
"name": "localsSyslog"
},
{
"streams": [
"Microsoft-Syslog"
],
"facilityNames": [
"authpriv"
],
"logLevels": [
"Error",
"Alert",
"Critical",
"Emergency"
],
"name": "authprivSyslog"
}
]
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.OperationalInsights/workspaces/Contoso",
"workspaceId": "11111111-2222-3333-4444-555555555555",
"name": "DataCollectionEvent"
}
]
},
"dataFlows": [
{
"streams": [
"Microsoft-Syslog"
],
"destinations": [
"DataCollectionEvent"
]
}
],
"provisioningState": "Succeeded"
},
"location": "centralus",
"kind": "Linux",
"id": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01",
"name": "Contoso-DCR-01",
"type": "Microsoft.Insights/dataCollectionRules",
"etag": "\"00000000-0000-0000-0000-000000000000\"",
"systemData": {
}
}
Syslog/CEF DCRA
عنوان URL لطلب إنشاء Syslog/CEF DCRA والعنوان
PUT
https://management.azure.com/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/LogForwarder-VM-1/providers/Microsoft.Insights/dataCollectionRuleAssociations/contoso-dcr-assoc?api-version=2022-06-01
نص طلب إنشاء Syslog/CEF DCRA
{
"properties": {
"dataCollectionRuleId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01"
}
}
استجابة إنشاء Syslog/CEF DCRA
{
"properties": {
"dataCollectionRuleId": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Insights/dataCollectionRules/Contoso-DCR-01"
},
"id": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/ContosoRG/providers/Microsoft.Compute/virtualMachines/LogForwarder-VM-1/providers/Microsoft.Insights/dataCollectionRuleAssociations/contoso-dcr-assoc",
"name": "contoso-dcr-assoc",
"type": "Microsoft.Insights/dataCollectionRuleAssociations",
"etag": "\"00000000-0000-0000-0000-000000000000\"",
"systemData": {
}
}
سجلات مخصصة من الملفات النصية
الأمثلة التالية مخصصة ل DCRs باستخدام AMA لجمع سجلات مخصصة من الملفات النصية.
سجلات النص المخصصة DCR
هذه الأمثلة هي لطلب واجهة برمجة التطبيقات لإنشاء DCR.
نص طلب إنشاء DCR لسجلات النص المخصص
فيما يلي مثال على طلب إنشاء DCR لملف نصي سجل مخصص. استبدل {PLACEHOLDER_VALUES}
بالقيم الفعلية.
المعلمة outputStream
مطلوبة فقط إذا غير التحويل مخطط الدفق.
{
"type": "Microsoft.Insights/dataCollectionRules",
"name": "{DCR_NAME}",
"location": "{WORKSPACE_LOCATION}",
"apiVersion": "2022-06-01",
"properties": {
"streamDeclarations": {
"Custom-Text-{TABLE_NAME}": {
"columns": [
{
"name": "TimeGenerated",
"type": "datetime"
},
{
"name": "RawData",
"type": "string"
},
]
}
},
"dataSources": {
"logFiles": [
{
"streams": [
"Custom-Text-{TABLE_NAME}"
],
"filePatterns": [
"{LOCAL_PATH_FILE_1}","{LOCAL_PATH_FILE_2}"
],
"format": "text",
"name": "Custom-Text-{TABLE_NAME}"
}
],
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "{WORKSPACE_RESOURCE_PATH}",
"workspaceId": "{WORKSPACE_ID}",
"name": "DataCollectionEvent"
}
],
},
"dataFlows": [
{
"streams": [
"Custom-Text-{TABLE_NAME}"
],
"destinations": [
"DataCollectionEvent"
],
"transformKql": "source",
"outputStream": "Custom-{TABLE_NAME}"
}
]
}
}
استجابة إنشاء DCR لسجلات النص المخصصة
{
"properties": {
"immutableId": "dcr-00112233445566778899aabbccddeeff",
"dataCollectionEndpointId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionEndpoints/Microsoft-Sentinel-aaaabbbbccccddddeeeefff",
"streamDeclarations": {
"Custom-Text-ApacheHTTPServer_CL": {
"columns": [
{
"name": "TimeGenerated",
"type": "datetime"
},
{
"name": "RawData",
"type": "string"
}
]
}
},
"dataSources": {
"logFiles": [
{
"streams": [
"Custom-Text-ApacheHTTPServer_CL"
],
"filePatterns": [
"C:\\Server\\bin\\log\\Apache24\\logs\\*.log"
],
"format": "text",
"settings": {
"text": {
"recordStartTimestampFormat": "ISO 8601"
}
},
"name": "Custom-Text-ApacheHTTPServer_CL"
}
]
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/contoso-rg-1/providers/Microsoft.OperationalInsights/workspaces/CyberSOC",
"workspaceId": "cccccccc-3333-4444-5555-dddddddddddd",
"name": "DataCollectionEvent"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-Text-ApacheHTTPServer_CL"
],
"destinations": [
"DataCollectionEvent"
],
"transformKql": "source",
"outputStream": "Custom-ApacheHTTPServer_CL"
}
],
"provisioningState": "Succeeded"
},
"location": "centralus",
"tags": {
"createdBy": "Sentinel"
},
"id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionRules/DCR-CustomLogs-01",
"name": "DCR-CustomLogs-01",
"type": "Microsoft.Insights/dataCollectionRules",
"etag": "\"00000000-1111-2222-3333-444444444444\"",
"systemData": {
"createdBy": "gbarnes@contoso.com",
"createdByType": "User",
"createdAt": "2024-08-12T09:29:15.1083961Z",
"lastModifiedBy": "gbarnes@contoso.com",
"lastModifiedByType": "User",
"lastModifiedAt": "2024-08-12T09:29:15.1083961Z"
}
}