Format of logs archived to storage through Azure Monitor to change

If you are archiving diagnostic logs or activity logs to a storage account through Azure Monitor be aware that on Nov 1, 2018 there will be a breaking change in the format.

The current format of the PT1H.json file in the storage account uses a JSON array or records. This looks something like:

    "records": [
            "time": "2016-01-05T01:32:01.2691226Z"
            "time": "2016-01-05T01:33:56.5264523Z"

The blob format will be change to JSON lines. This means each record will be delimited by a newline, with no outer records array and no commas between JSON records:

{"time": "2016-01-05T01:32:01.2691226Z"}
{"time": "2016-01-05T01:33:56.5264523Z"}

More information

Please review the documentation on how to find out if you are affected by this change and how to mitigate.

Show Comments