Azure Log Analytics Ingestion API

openapi: 3.0.3
info:
  title: Azure Log Analytics Ingestion API
  description: The Logs Ingestion API in Azure Monitor lets you send data to a Log Analytics workspace using REST API calls or client libraries. Send data to supported Azure tables or custom tables using data collection rules (DCR) for transformation and routing.
  version: '2023-01-01'
  contact:
    name: Microsoft Azure Support
    url: https://azure.microsoft.com/en-us/support/
  license:
    name: Microsoft Azure Terms
    url: https://azure.microsoft.com/en-us/support/legal/
  x-generated-from: documentation
  x-last-validated: '2026-04-18'
servers:
- url: https://{endpoint}
  description: Data collection endpoint or DCR logs ingestion endpoint
  variables:
    endpoint:
      default: my-dce.eastus-1.ingest.monitor.azure.com
      description: The data collection endpoint URL
security:
- bearerAuth: []
tags:
- name: Ingestion
  description: Send log data to Log Analytics workspaces
paths:
  /dataCollectionRules/{dcrImmutableId}/streams/{streamName}:
    post:
      operationId: uploadLogs
      summary: Azure Log Analytics Upload Logs
      description: Send custom log data to a Log Analytics workspace via a data collection rule. The data must be a JSON array matching the stream schema defined in the DCR. Transformations defined in the DCR are applied before data reaches the target table.
      tags:
      - Ingestion
      parameters:
      - name: dcrImmutableId
        in: path
        required: true
        description: The immutable ID of the data collection rule. Found on the DCR overview page in the Azure portal.
        schema:
          type: string
        example: dcr-000a00a000a00000a000000aa000a0aa
      - name: streamName
        in: path
        required: true
        description: The stream name in the DCR that should handle the data. Use Custom-TableName for custom tables.
        schema:
          type: string
        example: Custom-MyTable
      - name: api-version
        in: query
        required: true
        description: The API version to use.
        schema:
          type: string
          default: '2023-01-01'
      - name: Content-Encoding
        in: header
        required: false
        description: Set to gzip for compressed payloads.
        schema:
          type: string
          enum:
          - gzip
      - name: x-ms-client-request-id
        in: header
        required: false
        description: String-formatted GUID for request tracking.
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        description: JSON array of log entries matching the stream schema defined in the data collection rule. Must be UTF-8 encoded.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogEntryArray'
            examples:
              UploadLogsRequestExample:
                summary: Default uploadLogs request
                x-microcks-default: true
                value:
                - TimeGenerated: '2025-03-15T14:30:00Z'
                  Computer: web-server-01
                  AdditionalContext: Application startup complete
                - TimeGenerated: '2025-03-15T14:31:00Z'
                  Computer: web-server-02
                  AdditionalContext: Health check passed
      responses:
        '204':
          description: No Content - Data accepted successfully.
        '400':
          description: Bad request - malformed payload or schema mismatch.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UploadLogs400Example:
                  summary: Default uploadLogs 400 response
                  x-microcks-default: true
                  value:
                    error:
                      code: InvalidPayload
                      message: The payload does not match the expected stream schema.
        '401':
          description: Unauthorized - invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden - insufficient permissions on the DCR.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not found - DCR or stream does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Payload too large - exceeds maximum size limit.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - rate limit exceeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service unavailable - temporary server issue.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse:
      type: object
      description: Error response from the ingestion API.
      properties:
        error:
          $ref: '#/components/schemas/ErrorDetail'
    LogEntryArray:
      type: array
      description: Array of log entry objects. Each object must match the stream schema defined in the data collection rule.
      items:
        $ref: '#/components/schemas/LogEntry'
      minItems: 1
    ErrorDetail:
      type: object
      description: Detailed error information.
      properties:
        code:
          type: string
          description: Error code identifier.
          example: InvalidPayload
        message:
          type: string
          description: Human-readable error message.
          example: The payload does not match the expected stream schema.
    LogEntry:
      type: object
      description: A single log entry. The schema must match the stream declaration in the data collection rule. Custom columns must have the _CF suffix for Azure tables.
      properties:
        TimeGenerated:
          type: string
          format: date-time
          description: The timestamp of the log entry.
          example: '2025-03-15T14:30:00Z'
        Computer:
          type: string
          description: The computer or source generating the log.
          example: web-server-01
        AdditionalContext:
          type: string
          description: Additional context or message for the log entry.
          example: Application startup complete
      additionalProperties: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Microsoft Entra ID OAuth2 Bearer token obtained via client credentials flow. Use scope https://monitor.azure.com/.default for Azure public cloud.