{"id":1442,"date":"2023-04-02T20:51:36","date_gmt":"2023-04-02T19:51:36","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=1442"},"modified":"2023-04-03T11:47:51","modified_gmt":"2023-04-03T10:47:51","slug":"understanding-azure-data-collection-endpoint","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=1442","title":{"rendered":"Understanding Azure Data Collection Endpoint"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Azure <strong>Data Collection Endpoint (DCE)<\/strong> provide a connection for certain data sources of Azure Monitor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article gives you an <strong>introduction<\/strong> to DCE &#8211; and <strong>when<\/strong> and <strong>how to use it<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This blog-post is part of a series of blog posts to <a href=\"https:\/\/mortenknudsen.net\/?p=1687\" target=\"_blank\" rel=\"noreferrer noopener\">master Azure logging in depth (overview)<\/a>. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized is-style-default\"><a href=\"https:\/\/mortenknudsen.net\/?p=1687\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25.png\" alt=\"\" class=\"wp-image-2124\" width=\"434\" height=\"502\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25.png 867w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25-259x300.png 259w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-25-768x889.png 768w\" sizes=\"auto, (max-width: 434px) 100vw, 434px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get you started, you can find <a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">ARM-templates &amp; scripts in my AzureLogLibrary (github)<\/a>. Details will be covered in the articles.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibarary\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-1024x466.png\" alt=\"\" class=\"wp-image-2125\" width=\"400\" height=\"182\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-1024x466.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-300x137.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26-768x349.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-26.png 1057w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Quick links<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"#when\">When do I need a DCE ?<\/a><br><a href=\"#dataflow\">Dataflow of DCE use-cases<\/a><br><a href=\"#example-custom\">Example sending data into custom log<\/a><br><a href=\"#example-network\">Example sending data using network isolation<\/a><br><a href=\"#detailed\">Detailed example with AMPLS and network isolation<\/a><br><a href=\"#what\">What does a DCE consist of ?<\/a><br><a href=\"#region\">Regionality<\/a><br><a href=\"#naming\">Naming of DCEs<\/a><br><a href=\"#limitations\">Limitations<\/a><br><a href=\"#layout\">Layout of DCE (JSON)<\/a><br><a href=\"#gui-network\">Change Network isolation of DCE in GUI<\/a><br><a href=\"#how-gui\">How to deploy DCE using GUI ?<\/a><br><a href=\"#how-arm\">How to deploy DCE using ARM-templates ?<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><br>When do I need a DCE ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">DCE is as a connector between the endpoint and Azure Log Ingestion Pipeline. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A DCE is required in 2 occasions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You need network isolation<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You are sending data to custom logs in Azure LogAnalytics<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"541\" height=\"196\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-9.png\" alt=\"\" class=\"wp-image-1870\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-9.png 541w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-9-300x109.png 300w\" sizes=\"auto, (max-width: 541px) 100vw, 541px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"dataflow\">Dataflow of DCE use-cases<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"example-custom\">Example sending data into custom log<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here you can see that Azure Monitor Agent collections into standard tables are not using DCEs. But below you can see an example, where a script is using Log Ingestion API and sending data into custom log tables.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"556\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-1-1024x556.png\" alt=\"\" class=\"wp-image-1860\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-1-1024x556.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-1-300x163.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-1-768x417.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-1.png 1046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"example-network\">Example sending data using network isolation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By default connectivity is happening by a public network endpoint. You can also choose to use Azure Monitor Private Link Scope (AMPLS). I will cover this in a later blog-post.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"722\" height=\"555\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-2.png\" alt=\"\" class=\"wp-image-1861\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-2.png 722w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-2-300x231.png 300w\" sizes=\"auto, (max-width: 722px) 100vw, 722px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"detailed\">Detailed example with AMPLS and network isolation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here is a detailed illustration of the network and usage of DCE in a network isolation scenario.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"718\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-3-1024x718.png\" alt=\"\" class=\"wp-image-1862\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-3-1024x718.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-3-300x210.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-3-768x538.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-3.png 1063w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"what\">What does a DCE consist of ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A DCE includes the following components:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Component<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>Configuration access endpoint<\/td><td>The endpoint used to access the configuration service to fetch associated data collection rules (DCRs) for Azure Monitor Agent.<br><br>Example:&nbsp;<code>&lt;unique-dce-identifier&gt;.&lt;regionname&gt;.handler.control<\/code>.<\/td><\/tr><tr><td>Logs ingestion endpoint<\/td><td>The endpoint used to ingest logs to Log Analytics workspaces.<br><br>Example:&nbsp;<code>&lt;unique-dce-identifier&gt;.&lt;regionname&gt;.ingest<\/code>.<\/td><\/tr><tr><td>Network access control lists<\/td><td>Network access control rules for the endpoints.<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\"><br><\/figcaption><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"regionality\">Regionality<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Data collection endpoints are resources created within specific regions. <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">An endpoint in a given region&nbsp;<strong>can only<\/strong> be associated with machines in the <strong>same region<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means that if your LogAnalytics workspace is created in WestEurope, your DCE must also be placed in WestEurope.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">You can have more than one endpoint within the same region according to your needs. <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Each DCE will get a unique IP address, which can be whitelisted in your firewall.<\/p>\n<\/blockquote>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"naming\">Naming of DCEs<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Typically I will create a DCE per collection type and use the naming to describe the collection type &#8211; and where I am using the data (destination). Here are a few naming examples:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">dce-ampls-srv-weu-t<br>dce-iis-logs<br>dce-iis-logs-westeurope<br>dce-java-textlogs-westeurope<br>dce-log-platform-management-client-p<br>dce-platform-management-srvnetworkcloud-p<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"limitations\">Limitations<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Data collection endpoints only support Log Analytics workspaces as a destination for collected data.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/azure-monitor\/essentials\/metrics-custom-overview\">Custom metrics (preview)<\/a>&nbsp;collected and uploaded via Azure Monitor Agent aren&#8217;t currently controlled by DCEs. They also can&#8217;t be configured over private links.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"layout\">Layout of DCE (JSON)<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The layout of a DCE consists of important properties defining the <strong>immutableId<\/strong>, <strong>configurationsAccess<\/strong> and <strong>log ingestion endpoint Uri<\/strong>. Furthermore you control if you allow <strong>publicNetworkAccess<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>{\n    \"properties\": {\n        \"immutableId\": \"dce-e9ddc3ad1e50418cb951e967c58870b5\",\n        \"configurationAccess\": {\n            \"endpoint\": \"https:\/\/dce-platform-management-srvnetworkcloud-p-9gct.westeurope-1.handler.control.monitor.azure.com\"\n        },\n        \"logsIngestion\": {\n            \"endpoint\": \"https:\/\/dce-platform-management-srvnetworkcloud-p-9gct.westeurope-1.ingest.monitor.azure.com\"\n        },\n        \"networkAcls\": {\n            \"publicNetworkAccess\": \"Enabled\"\n        },\n        \"provisioningState\": \"Succeeded\"\n    },\n    \"location\": \"westeurope\",\n    \"id\": \"\/subscriptions\/xxxxx4d8-bf1701b862c3\/resourceGroups\/rg-dce\/providers\/Microsoft.Insights\/dataCollectionEndpoints\/dce-platform-management-srvnetworkcloud-p\",\n    \"name\": \"dce-platform-management-srvnetworkcloud-p\",\n    \"type\": \"Microsoft.Insights\/dataCollectionEndpoints\",\n    \"etag\": \"\\\"bb00a0e1-0000-0d00-0000-64045da20000\\\"\",\n    \"systemData\": {\n        \"createdBy\": \"mok@2linkit.net\",\n        \"createdByType\": \"User\",\n        \"createdAt\": \"2023-03-05T09:15:11.3267788Z\",\n        \"lastModifiedBy\": \"mok@2linkit.net\",\n        \"lastModifiedByType\": \"User\",\n        \"lastModifiedAt\": \"2023-03-05T09:15:11.3267788Z\"\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also find the details in the GUI. You will need these information, if you want to send data using Azure Log Ingestion API via REST endpoint.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"287\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-8-1024x287.png\" alt=\"\" class=\"wp-image-1867\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-8-1024x287.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-8-300x84.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-8-768x216.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-8-1536x431.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-8.png 1753w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"gui-network\">Change Network isolation of DCE in GUI<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to change a DCE and use it in a more secure configuration, you can change the settings under <strong>network isolation<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"592\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-6-1024x592.png\" alt=\"\" class=\"wp-image-1865\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-6-1024x592.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-6-300x174.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-6-768x444.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-6-1536x889.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-6.png 1801w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is an example with Azure Monitor private Link Scope (AMPLS)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"852\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-7-1024x852.png\" alt=\"\" class=\"wp-image-1866\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-7-1024x852.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-7-300x250.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-7-768x639.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-7.png 1226w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"how-gui\">How to deploy DCE using GUI ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Data Collection Endpoint is configured in Azure Monitor<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"840\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-4-1024x840.png\" alt=\"\" class=\"wp-image-1863\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-4-1024x840.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-4-300x246.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-4-768x630.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-4.png 1324w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"682\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-5-1024x682.png\" alt=\"\" class=\"wp-image-1864\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-5-1024x682.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-5-300x200.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-5-768x512.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/image-5.png 1121w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"how-arm\">How to deploy DCE using ARM-templates ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You can check out the ARM-template on <a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">my Github<\/a>:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/raw.githubusercontent.com\/KnudsenMorten\/AzureLogLibrary\/main\/DataCollection\/dce-generic\/dce.json\" target=\"_blank\" rel=\"noreferrer noopener\">Generic Data Collection Endpoint (arm-template)<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/raw.githubusercontent.com\/KnudsenMorten\/AzureLogLibrary\/main\/DataCollection\/txt-logs\/dce-txt-logs.json\">Data Collection Endpoint for collection of TXT-logs<\/a> &#8211; used with <a href=\"https:\/\/raw.githubusercontent.com\/KnudsenMorten\/AzureLogLibrary\/main\/DataCollection\/txt-logs\/dcr-txt-logs.json\" target=\"_blank\" rel=\"noreferrer noopener\">DCR<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/raw.githubusercontent.com\/KnudsenMorten\/AzureLogLibrary\/main\/DataCollection\/iis-logs\/dce-iis-logs.json\" target=\"_blank\" rel=\"noreferrer noopener\">Data Collection Endpoint for collection of IIS-logs<\/a> &#8211; used with <a href=\"https:\/\/raw.githubusercontent.com\/KnudsenMorten\/AzureLogLibrary\/main\/DataCollection\/iis-logs\/dcr-windows-vmhealth-iis-logs-W3SVCx.json\" target=\"_blank\" rel=\"noreferrer noopener\">DCR<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/KnudsenMorten\/AzureLogLibrary\" target=\"_blank\" rel=\"noreferrer noopener\">I have also provided more documentation and powershell script to deploy more DCRs and DCEs<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also choose to click and do the deployment directly to your Azure environment<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Deploy Generic Data Collection Endpoint (DCE)<\/h3>\n\n\n\n<a href=\"https:\/\/portal.azure.com\/#create\/Microsoft.Template\/uri\/https%3A%2F%2Fraw.githubusercontent.com%2FKnudsenMorten%2FAzureLogLibrary%2Fmain%2FDataCollection%2Fdce-generic%2Fdce.json\" target=\"_blank\" rel=\"noopener\">\n  <img decoding=\"async\" src=\"https:\/\/aka.ms\/deploytoazurebutton\">\n<\/a>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Deploy DCE for TXT-log collection<\/h3>\n\n\n\n<a href=\"https:\/\/portal.azure.com\/#create\/Microsoft.Template\/uri\/https%3A%2F%2Fraw.githubusercontent.com%2FKnudsenMorten%2FAzureLogLibrary%2Fmain%2FDataCollection%2Ftxt-logs%2Fdcr-txt-logs.json\" target=\"_blank\" rel=\"noopener\">\n  <img decoding=\"async\" src=\"https:\/\/aka.ms\/deploytoazurebutton\">\n<\/a>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Deploy DCE for IIS-log collection<\/h3>\n\n\n\n<a href=\"https:\/\/portal.azure.com\/#create\/Microsoft.Template\/uri\/https%3A%2F%2Fraw.githubusercontent.com%2FKnudsenMorten%2FAzureLogLibrary%2Fmain%2FDataCollection%2Fiis-logs%2Fdce-iis-logs.json\" target=\"_blank\" rel=\"noopener\">\n  <img decoding=\"async\" src=\"https:\/\/aka.ms\/deploytoazurebutton\">\n<\/a>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Azure Data Collection Endpoint (DCE) provide a connection for certain data sources of Azure Monitor. This article gives you an &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Understanding Azure Data Collection Endpoint\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=1442#more-1442\" aria-label=\"Read more about Understanding Azure Data Collection Endpoint\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":1869,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[140,55,59,129,131,61,128,54,143,141,57,28,139,136,138,137,142,133,134,60,132,58,145,135,144],"tags":[],"class_list":["post-1442","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ama","category-azure","category-azure-arc","category-azure-data-collection-rules","category-azure-data-ingestion-pipeline","category-azure-extensions","category-azure-log-ingestion-api","category-azure-loganalytics","category-azure-logging","category-azure-monitor-agent","category-azure-security","category-community","category-data-collection-endpoint","category-data-transformation","category-dce","category-dcr","category-logging","category-microsoft-security","category-mvpbuzz","category-scripting","category-security","category-sentinel","category-servicemap","category-transformation","category-vminsight","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/DCE.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2023\/04\/DCE.png","_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1442"}],"version-history":[{"count":25,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1442\/revisions"}],"predecessor-version":[{"id":2138,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/1442\/revisions\/2138"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/1869"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}