Azure Log Analytics · Rate Limits

Azure Log Analytics Rate Limits

Azure Log Analytics enforces ingestion rate limits per Data Collection Rule and per workspace, query rate limits per user, and a soft per-workspace ingestion-volume rate (default ~500 MB/min compressed, approximately 6 GB/min uncompressed). Throttled queries return HTTP 429 with Retry-After. Data Collector API has separate per-post and per-field size limits.

Azure Log Analytics Rate Limits is the machine-readable rate-limit profile for Azure Log Analytics on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 19 rate-limit definitions, measuring GB_per_minute, requests_per_minute, MB, KB, and MB_per_minute.

The profile also includes 5 backoff/retry policies defined and response codes documented for throttled.

Tagged areas include Observability, Logs, and Rate Limiting.

19 Limits Throttle: 429
ObservabilityLogsRate Limiting

Limits

Logs Ingestion API - data per minute per DCR dataCollectionRule
GB_per_minute · minute
2
System may auto-scale gradual increases; abrupt spikes throttled.
Logs Ingestion API - requests per minute per DCR dataCollectionRule
requests_per_minute · minute
12000
Logs Ingestion API - max API call size request
MB
1
Compressed and uncompressed.
Logs Ingestion API - max field value field
KB
64
Truncated above 64 KB.
Workspace ingestion volume rate (soft) workspace
MB_per_minute · minute
500
~6 GB/min uncompressed. 4 retries over 12 hours then drop. Raise via support.
Concurrent Analytics queries per user user
concurrent_queries
5
Concurrent Basic / Auxiliary queries per user user
concurrent_queries
2
Time in concurrency queue user
minutes · minute
3
Queries queued > 3 minutes are terminated with 429.
Total queries in concurrency queue user
queries
200
Beyond this, additional queries return 429.
Query rate per user user
queries_per_30s · second
200
Activity log API query rate user
queries_per_30s · second
50
Query API - max records returned query
records
500000
Query API - max data returned query
MB
100
Query API - max running time query
minutes · minute
10
Query API - request rate user/clientIP
requests_per_30s · second
200
Data Collector API - max single post request
MB
30
Alerts API - Get Summary subscription
requests_per_minute · minute
50
Alerts API - Get All subscription
requests_per_minute · minute
100
Alerts API - Other subscription
requests_per_minute · minute
1000

Policies

Backoff with Retry-After
Throttled requests return 429 with Retry-After. Honor it; do not retry tighter.
Daily ingestion cap
Customers can configure a per-workspace daily cap; ingest stops when cap is reached and resumes the next UTC day.
Volume-rate raise via support
The 500 MB/min compressed soft limit can be raised by contacting Azure support before planned spikes.
Optimize KQL
Use efficient KQL (project early, filter early, summarize). Heavy queries count against concurrency.
Field truncation
Field values > 32 KB (Data Collector) or > 64 KB (Logs Ingestion) are truncated, not rejected.

Sources