Data Rule Collection Extension DependencyAgent not working

[Erylis21]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.1.4

AzureRM Provider Version

3.23.0

Affected Resource(s)/Data Source(s)

azurerm_monitor_data_collection_rule

Terraform Configuration Files

dcr_linux = {
  description = "Métriques/logs des machines linux France Central"
  kind        = "Linux"
  name        = "DCR-LINUX-FR"
  performance_counter = {
    "perfcounter30" = {
      counter_specifiers = [
        "\\Processor Information(_Total)\\% Processor Time",
        "\\Processor Information(_Total)\\% Privileged Time",
        "\\Processor Information(_Total)\\% User Time",
        "\\Processor Information(_Total)\\Processor Frequency",
        "\\System\\Processes",
        "\\Process(_Total)\\Thread Count",
        "\\Process(_Total)\\Handle Count",
        "\\System\\System Up Time",
        "\\System\\Context Switches/sec",
        "\\System\\Processor Queue Length",
        "\\Memory\\% Committed Bytes In Use",
        "\\Memory\\Available Bytes",
        "\\Memory\\Committed Bytes",
        "\\Memory\\Cache Bytes",
        "\\Memory\\Pool Paged Bytes",
        "\\Memory\\Pool Nonpaged Bytes",
        "\\Memory\\Pages/sec",
        "\\Memory\\Page Faults/sec",
        "\\Process(_Total)\\Working Set",
        "\\Process(_Total)\\Working Set - Private",
      ]
      sampling_frequency_in_seconds = 30
      streams                       = ["Microsoft-Perf"]
    }
    "perfcounter60" = {
      counter_specifiers = [
        "\\LogicalDisk(_Total)\\% Disk Time",
        "\\LogicalDisk(_Total)\\% Disk Read Time",
        "\\LogicalDisk(_Total)\\% Disk Write Time",
        "\\LogicalDisk(_Total)\\% Idle Time",
        "\\LogicalDisk(_Total)\\Disk Bytes/sec",
        "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
        "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
        "\\LogicalDisk(_Total)\\Disk Transfers/sec",
        "\\LogicalDisk(_Total)\\Disk Reads/sec",
        "\\LogicalDisk(_Total)\\Disk Writes/sec",
        "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
        "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
        "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
        "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
        "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
        "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
        "\\LogicalDisk(_Total)\\% Free Space",
        "\\LogicalDisk(_Total)\\Free Megabytes",
        "\\Network Interface(*)\\Bytes Total/sec",
        "\\Network Interface(*)\\Bytes Sent/sec",
        "\\Network Interface(*)\\Bytes Received/sec",
        "\\Network Interface(*)\\Packets/sec",
        "\\Network Interface(*)\\Packets Sent/sec",
        "\\Network Interface(*)\\Packets Received/sec",
        "\\Network Interface(*)\\Packets Outbound Errors",
        "\\Network Interface(*)\\Packets Received Errors",
      ]
      sampling_frequency_in_seconds = 60
      streams                       = ["Microsoft-Perf"]
    }
"insight" = {
      counter_specifiers            = ["\\VmInsights\\DetailedMetrics"]
      sampling_frequency_in_seconds = 60
      streams                       = ["Microsoft-InsightsMetrics"]
    }
  }
  streams = [
    "Microsoft-Syslog",
    "Microsoft-Perf",
    "Microsoft-InsightsMetrics",
    "Microsoft-ServiceMap"
  ]
  syslog = {
    name           = "syslog"
    facility_names = ["*"]
    log_levels     = ["*"]
  }
}
-----------------------------------------------
resource "azurerm_monitor_data_collection_rule" "dcr_linux" {

  name        = var.dcr_linux.name
  description = var.dcr_linux.description
  kind        = var.dcr_linux.kind

  resource_group_name = azurerm_resource_group.resource_group_infra.name
  location            = azurerm_resource_group.resource_group_infra.location

  destinations {
    log_analytics {
      workspace_resource_id = module.automation.log_analytics_workspace.id
      name                  = "log-analytics"
    }
  }

  data_flow {
    streams      = var.dcr_linux.streams
    destinations = ["log-analytics"]
  }

  data_sources {

    syslog {
      name           = var.dcr_linux.syslog.name
      facility_names = var.dcr_linux.syslog.facility_names
      log_levels     = var.dcr_linux.syslog.log_levels
    }

    dynamic "performance_counter" {
      for_each = var.dcr_windows.performance_counter

      content {
        name                          = performance_counter.key
        streams                       = performance_counter.value.streams
        sampling_frequency_in_seconds = performance_counter.value.sampling_frequency_in_seconds
        counter_specifiers            = performance_counter.value.counter_specifiers
      }
    }

    extension {
      name           = "DependencyAgentDataSource"
      streams        = ["Microsoft-ServiceMap"]
      extension_name = "DependencyAgent"
    }
  }

  tags = var.tags
}

Debug Output/Panic Output

╷
│ Error: expected data_flow.0.streams.3 to be one of [Microsoft-Event Microsoft-InsightsMetrics Microsoft-Perf Microsoft-Syslog Microsoft-WindowsEvent], got Microsoft-ServiceMap
│ 
│   with azurerm_monitor_data_collection_rule.dcr_linux,
│   on main.tf line 76, in resource "azurerm_monitor_data_collection_rule" "dcr_linux":
│   76:     streams      = var.dcr_linux.streams
│ 
╵
╷
│ Error: expected data_sources.0.extension.0.streams.0 to be one of [Microsoft-Event Microsoft-InsightsMetrics Microsoft-Perf Microsoft-Syslog Microsoft-WindowsEvent], got Microsoft-ServiceMap
│ 
│   with azurerm_monitor_data_collection_rule.dcr_linux,
│   on main.tf line 101, in resource "azurerm_monitor_data_collection_rule" "dcr_linux":
│  101:       streams        = ["Microsoft-ServiceMap"]

Expected Behaviour

The stream is supposed to work. When the rule is created from the azure portal (Monitor > Virtual Machines > Not Monitored > Enable) the parameters are configured as follow { "properties": { "description": "Data collection rule for VM Insights.", "immutableId": "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxx", "dataSources": { "performanceCounters": [ { "streams": [ "Microsoft-InsightsMetrics" ], "samplingFrequencyInSeconds": 60, "counterSpecifiers": [ "\\VmInsights\\DetailedMetrics" ], "name": "VMInsightsPerfCounters" } ], "extensions": [ { "streams": [ "Microsoft-ServiceMap" ], "extensionName": "DependencyAgent", "extensionSettings": {}, "name": "DependencyAgentDataSource" } ] }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "xxxx/xxxxxxxxxxxxxx/xxxxxxxxx", "workspaceId": "xxxxx-xxxxx-xxxxx-xxxxx-xxxxxxxx", "name": "VMInsightsPerf-Logs-Dest" } ] }, "dataFlows": [ { "streams": [ "Microsoft-InsightsMetrics" ], "destinations": [ "VMInsightsPerf-Logs-Dest" ] }, { "streams": [ "Microsoft-ServiceMap" ], "destinations": [ "VMInsightsPerf-Logs-Dest" ] } ], "provisioningState": "Succeeded" }, "location": "francecentral", "id": "/subscriptions/xxxxx-xxxxxx-xxxxxx/resourceGroups/xxxxx-xxxxx/providers/Microsoft.Insights/dataCollectionRules/MSVMI-TEST", "name": "MSVMI-TEST", "type": "Microsoft.Insights/dataCollectionRules", "etag": "\"xxxxx-xxxxx-xxxxx\"", }

Actual Behaviour

The stream "Microsoft-ServiceMap" is unkown and cannot be used.

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[teowa]

Hi @Erylis21 , thanks for taking the time to issue this. Seems Microsoft-ServiceMap is a new type of streams that has not released in REST API specifications, the current newest stable version 2021-04-01 of Data Collection Rule only support for 5 stream types: [Microsoft-Event Microsoft-InsightsMetrics Microsoft-Perf Microsoft-Syslog Microsoft-WindowsEvent]. And we are going to add the new stream type as soon as the new stable version API is released.

[evandeworp]

@teowa, I'm not sure the REST API specification says only those 5 stream types are supported. The REST API spec https://github.com/Azure/azure-rest-api-specs/blob/main/specification/monitor/resource-manager/Microsoft.Insights/stable/2021-04-01/dataCollectionRules_API.json has this:

    "DataFlow": {
      "description": "Definition of which streams are sent to which destinations.",
      "type": "object",
      "properties": {
        "streams": {
          "description": "List of streams for this data flow.",
          "type": "array",
          "items": {
            "enum": [
              "Microsoft-Event",
              "Microsoft-InsightsMetrics",
              "Microsoft-Perf",
              "Microsoft-Syslog",
              "Microsoft-WindowsEvent"
            ],
            "type": "string",
            "x-ms-enum": {
              "name": "KnownDataFlowStreams",
              "modelAsString": true
            }
          }
        },

where xs-ms-enum has modelAsString:true. According to https://github.com/Azure/autorest/issues/2950

In Azure, when we mark an enum with x-ms-enum and modelAsString:true we're telling the generator that the list of values can expand later, and it should generate something that won't break (and is tolerant of taking any value, regardless of it being in the set of known values).

I take this to mean those 5 streams were the known stream types when stable/2021-04-01 API was published but the API does not restrict the streams to those exact 5 types.

To demonstrate this, I created a data collection rule with "Microsoft-ServiceMap" stream type using the terraform module "azapi":

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "= 3.27.0"
    }
    azapi = {
      source = "Azure/azapi"
      version = "= 1.0.0"      
    }
  }

  required_version = "= 1.2.9"
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "example-workspace"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
}


resource "azapi_resource" "example" {
  type      = "Microsoft.Insights/dataCollectionRules@2021-04-01"
  name      = "example-rule"
  parent_id = azurerm_resource_group.example.id
  location  = azurerm_resource_group.example.location

  body = jsonencode(
    {
      properties = {
        description  = "Data collection rule for VM Insights."

        dataFlows = [
          {
            destinations = ["VMInsightsPerf-Logs-Dest"]
            streams      = ["Microsoft-InsightsMetrics"]
          },
          {
            destinations = ["VMInsightsPerf-Logs-Dest"]
            streams      = ["Microsoft-ServiceMap"]
          }          
        ]

        dataSources = {
          extensions = [
            {
              extensionName = "DependencyAgent"
              name          = "DependencyAgentDataSource"
              streams       = ["Microsoft-ServiceMap"]
            }
          ]

          performanceCounters = [
            {
              counterSpecifiers          = ["\\VmInsights\\DetailedMetrics"]
              name                       = "VMInsightsPerfCounters"
              samplingFrequencyInSeconds = 60
              streams                    = ["Microsoft-InsightsMetrics"]
            }
          ]
        }

        destinations = {
          logAnalytics = [
            {
              name                = "VMInsightsPerf-Logs-Dest"
              workspaceResourceId = azurerm_log_analytics_workspace.example.id
            }
          ]
        }
      }
    }
  )
}

When applying this terraform, I can see the following JSON goes to the REST API successfully:

=====> Try=1 PUT https://management.azure.com/subscriptions/xxx/resourceGroups/example-resources/providers/Microsoft.Insights/dataCollectionRules/example-rule?api-version=2021-04-01: timestamp=2022-10-19T11:34:23.961-0400
2022-10-19T11:34:23.962-0400 [DEBUG] provider.terraform-provider-azapi_v1.0.0.exe: Oct 19 11:34:23.961596 Request: ==> OUTGOING REQUEST (Try=1)
   PUT https://management.azure.com/subscriptions/xxx/resourceGroups/example-resources/providers/Microsoft.Insights/dataCollectionRules/example-rule?api-version=2021-04-01
   Accept: application/json
   Authorization: REDACTED
   Content-Length: 844
   Content-Type: application/json
   User-Agent: HashiCorp Terraform/1.2.9 (+https://www.terraform.io) Terraform Plugin SDK/2.8.0 terraform-provider-azapi/v1.0.0 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
   X-Ms-Correlation-Request-Id: REDACTED
   --------------------------------------------------------------------------------
{"location":"westeurope","properties":{"dataFlows":[{"destinations":["VMInsightsPerf-Logs-Dest"],"streams":["Microsoft-InsightsMetrics"]},{"destinations":["VMInsightsPerf-Logs-Dest"],"streams":["Microsoft-ServiceMap"]}],"dataSources":{"extensions":[{"extensionName":"DependencyAgent","name":"DependencyAgentDataSource","streams":["Microsoft-ServiceMap"]}],"performanceCounters":[{"counterSpecifiers":["\\VmInsights\\DetailedMetrics"],"name":"VMInsightsPerfCounters","samplingFrequencyInSeconds":60,"streams":["Microsoft-InsightsMetrics"]}]},"description":"Data collection rule for VM Insights.","destinations":{"logAnalytics":[{"name":"VMInsightsPerf-Logs-Dest","workspaceResourceId":"/subscriptions/xxx/resourceGroups/example-resources/providers/Microsoft.OperationalInsights/workspaces/example-workspace"}]}}}
   --------------------------------------------------------------------------------: timestamp=2022-10-19T11:34:23.961-0400
2022-10-19T11:34:30.230-0400 [DEBUG] provider.terraform-provider-azapi_v1.0.0.exe: Oct 19 11:34:30.230306 Response: ==> REQUEST/RESPONSE (Try=1/6.2687093s, OpTime=6.2687093s) -- RESPONSE RECEIVED
   PUT https://management.azure.com/subscriptions/xxx/resourceGroups/example-resources/providers/Microsoft.Insights/dataCollectionRules/example-rule?api-version=2021-04-01
   Accept: application/json
   Authorization: REDACTED
   Content-Length: 844
   Content-Type: application/json
   User-Agent: HashiCorp Terraform/1.2.9 (+https://www.terraform.io) Terraform Plugin SDK/2.8.0 terraform-provider-azapi/v1.0.0 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
   X-Ms-Correlation-Request-Id: REDACTED
   --------------------------------------------------------------------------------
   RESPONSE Status: 200 OK

Further, if I put a random stream type in the terraform like:

          {
            destinations = ["VMInsightsPerf-Logs-Dest"]
            streams      = ["SomeNonExistentStreamType"]
          },

then the REST API says the stream is invalid, but it also returns a long list of over 200 valid stream types, if I count correctly, instead of just the 5 stream types that azurerm_monitor_data_collection_rule restricts us to:

│ {
│   "error": {
│     "code": "InvalidPayload",
│     "message": "Data collection rule is invalid",
│     "details": [
│       {
│         "code": "InvalidStream",
│         "message": "'Streams' stream 'SomeNonExistentStreamType' must be a custom stream or one of: Microsoft-AACAudit,Microsoft-AACHttpRequest,Microsoft-AADDomainServicesAccountLogon,Microsoft-AADDomainServicesAccountManagement,Microsoft-AADDomainServicesDirectoryServiceAccess,Microsoft-AADDomainServicesLogonLogoff,Microsoft-AADDomainServicesPolicyChange,Microsoft-AADDomainServicesPrivilegeUse,Microsoft-AADManagedIdentitySignInLogs,Microsoft-AADNonInteractiveUserSignInLogs,Microsoft-AADProvisioningLogs,Microsoft-AADServicePrincipalSignInLogs,Microsoft-ABSBotRequests,Microsoft-ACSAuthIncomingOperations,Microsoft-ACSBillingUsage,Microsoft-ACSChatIncomingOperations,Microsoft-ACSSMSIncomingOperations,Microsoft-ADAssessmentRecommendation,Microsoft-ADFActivityRun,Microsoft-ADFPipelineRun,Microsoft-ADFSSignInLogs,Microsoft-ADFTriggerRun,Microsoft-ADPAudit,Microsoft-ADPDiagnostics,Microsoft-ADPRequests,Microsoft-ADReplicationResult,Microsoft-ADSecurityAssessmentRecommendation,Microsoft-ADTDigitalTwinsOperation,Microsoft-ADTModelsOperation,Microsoft-ADTQueryOperation,Microsoft-ADXCommand,Microsoft-ADXQuery,Microsoft-AegDeliveryFailureLogs,Microsoft-AegPublishFailureLogs,Microsoft-Alert-Nagios,Microsoft-Alert-Oms,Microsoft-AmlOnlineEndpointConsoleLog,Microsoft-AntiMalwareStatus,Microsoft-ApiManagementGatewayLogs,Microsoft-AppAvailabilityResults,Microsoft-AppBrowserTimings,Microsoft-AppCenterError,Microsoft-AppDependencies,Microsoft-AppEvents,Microsoft-AppExceptions,Microsoft-AppMetrics,Microsoft-AppPageViews,Microsoft-AppPerformanceCounters,Microsoft-AppPlatformSystemLogs,Microsoft-AppRequests,Microsoft-AppServiceAppLogs,Microsoft-AppServiceAuditLogs,Microsoft-AppServiceConsoleLogs,Microsoft-AppServiceFileAuditLogs,Microsoft-AppServiceHTTPLogs,Microsoft-AppServicePlatformLogs,Microsoft-AppSystemEvents,Microsoft-AppTraces,Microsoft-ASimDnsActivityLogs,Microsoft-ASimNetworkSessionLogs,Microsoft-ASimNetworkSessionLogs-WindowsFirewall,Microsoft-Auditd,Microsoft-AuditLogs,Microsoft-AutoscaleEvaluationsLog,Microsoft-AutoscaleScaleActionsLog,Microsoft-AWSCloudTrail,Microsoft-AWSVPCFlow,Microsoft-AzureActivityV2,Microsoft-AzureAssessmentRecommendation,Microsoft-AzureDevOpsAuditing,Microsoft-BehaviorAnalytics,Microsoft-BlockchainApplicationLog,Microsoft-BlockchainProxyLog,Microsoft-CDBCassandraRequests,Microsoft-CDBControlPlaneRequests,Microsoft-CDBDataPlaneRequests,Microsoft-CDBGremlinRequests,Microsoft-CDBMongoRequests,Microsoft-CDBPartitionKeyRUConsumption,Microsoft-CDBPartitionKeyStatistics,Microsoft-CDBQueryRuntimeStatistics,Microsoft-CiscoAsa,Microsoft-CloudTrailEventData,Microsoft-CommonSecurityLog,Microsoft-ComputerGroup,Microsoft-ConfigurationChange,Microsoft-ConfigurationChangeV2,Microsoft-ConfigurationData,Microsoft-ContainerImageInventory,Microsoft-ContainerInventory,Microsoft-ContainerLog,Microsoft-ContainerLogV2,Microsoft-ContainerNodeInventory,Microsoft-ContainerServiceLog,Microsoft-CoreAzureBackup,Microsoft-DatabricksAccounts,Microsoft-DatabricksClusters,Microsoft-DatabricksDBFS,Microsoft-DatabricksInstancePools,Microsoft-DatabricksJobs,Microsoft-DatabricksNotebook,Microsoft-DatabricksSecrets,Microsoft-DatabricksSQLPermissions,Microsoft-DatabricksSSH,Microsoft-DatabricksWorkspace,Microsoft-DefenderForSqlAlerts,Microsoft-DefenderForSqlLogins,Microsoft-DefenderForSqlScanEvents,Microsoft-DefenderForSqlScanResults,Microsoft-DefenderForSqlTelemetry,Microsoft-DeviceNetworkInfo,Microsoft-DnsEvents,Microsoft-DnsEvents-Audit,Microsoft-DnsEvents-Dynamic,Microsoft-DnsInventory,Microsoft-DummyHydrationFact,Microsoft-Dynamics365Activity,Microsoft-EmailAttachmentInfo,Microsoft-EmailEvents,Microsoft-EmailPostDeliveryEvents,Microsoft-EmailUrlInfo,Microsoft-Event,Microsoft-ExchangeAssessmentRecommendation,Microsoft-FailedIngestion,Microsoft-FirewallLog,Microsoft-FunctionAppLogs,Microsoft-GCPAuditLogs,Microsoft-HDInsightAmbariClusterAlerts,Microsoft-HDInsightAmbariSystemMetrics,Microsoft-HDInsightHadoopAndYarnLogs,Microsoft-HDInsightHadoopAndYarnMetrics,Microsoft-HDInsightHBaseLogs,Microsoft-HDInsightHBaseMetrics,Microsoft-HDInsightHiveAndLLAPLogs,Microsoft-HDInsightHiveAndLLAPMetrics,Microsoft-HDInsightHiveTezAppStats,Microsoft-HDInsightKafkaMetrics,Microsoft-HDInsightOozieLogs,Microsoft-HDInsightSecurityLogs,Microsoft-HDInsightSparkApplicationEvents,Microsoft-HDInsightSparkBlockManagerEvents,Microsoft-HDInsightSparkEnvironmentEvents,Microsoft-HDInsightSparkExecutorEvents,Microsoft-HDInsightSparkJobEvents,Microsoft-HDInsightSparkLogs,Microsoft-HDInsightSparkSQLExecutionEvents,Microsoft-HDInsightSparkStageEvents,Microsoft-HDInsightSparkStageTaskAccumulables,Microsoft-HDInsightSparkTaskEvents,Microsoft-HealthStateChange,Microsoft-Heartbeat,Microsoft-HuntingBookmark,Microsoft-InsightsMetrics,Microsoft-IntuneAuditLogs,Microsoft-IntuneDevices,Microsoft-IntuneOperationalLogs,Microsoft-KubeEvents,Microsoft-KubeHealth,Microsoft-KubeMonAgentEvents,Microsoft-KubeNodeInventory,Microsoft-KubePodInventory,Microsoft-KubePVInventory,Microsoft-KubeServices,Microsoft-LAQueryLogs,Microsoft-McasShadowItReporting,Microsoft-MCCEventLogs,Microsoft-MicrosoftAzureBastionAuditLogs,Microsoft-MicrosoftDataShareReceivedSnapshotLog,Microsoft-MicrosoftDataShareSentSnapshotLog,Microsoft-MicrosoftHealthcareApisAuditLogs,Microsoft-NetworkMonitoring,Microsoft-NWConnectionMonitorPathResult,Microsoft-NWConnectionMonitorTestResult,Microsoft-OfficeActivity,Microsoft-Operation,Microsoft-OperationJson,Microsoft-OperationLog,Microsoft-Perf,Microsoft-PowerBIDatasetsWorkspace,Microsoft-ProcessInvestigator,Microsoft-ProtectionStatus,Microsoft-PurviewScanStatusLogs,Microsoft-RomeDetectionEvent,Microsoft-SCCMAssessmentRecommendation,Microsoft-SCOMAssessmentRecommendation,Microsoft-SecurityAlert,Microsoft-SecurityBaseline,Microsoft-SecurityBaselineSummary,Microsoft-SecurityDetection,MicrosoftSecurityDetection-ATA,Microsoft-SecurityEvent,Microsoft-SecurityIncident,Microsoft-SecurityIoTRawEvent,Microsoft-SecurityNestedRecommendation,Microsoft-SecurityRecommendation,Microsoft-SentinelHealth,Microsoft-ServiceMap,Microsoft-SfBOnlineAssessmentRecommendation,Microsoft-SharePointOnlineAssessmentRecommendation,Microsoft-SignalRServiceDiagnosticLogs,Microsoft-SigninLogs,Microsoft-SPAssessmentRecommendation,Microsoft-SQLAssessmentRecommendation,Microsoft-SqlAtpStatus-DefenderForSql,Microsoft-SQLSecurityAuditEvents,Microsoft-SucceededIngestion,Microsoft-SynapseBigDataPoolApplicationsEnded,Microsoft-SynapseBuiltinSqlPoolRequestsEnded,Microsoft-SynapseGatewayApiRequests,Microsoft-SynapseIntegrationActivityRuns,Microsoft-SynapseIntegrationPipelineRuns,Microsoft-SynapseIntegrationTriggerRuns,Microsoft-SynapseRbacOperations,Microsoft-SynapseSqlPoolDmsWorkers,Microsoft-SynapseSqlPoolExecRequests,Microsoft-SynapseSqlPoolRequestSteps,Microsoft-SynapseSqlPoolSqlRequests,Microsoft-SynapseSqlPoolWaits,Microsoft-Syslog,Microsoft-ThreatIntelligenceIndicator,Microsoft-Update,Microsoft-UpdateRunProgress,Microsoft-UpdateSummary,Microsoft-Usage,Microsoft-W3CIISLog,Microsoft-Watchlist,Microsoft-WindowsEvent,Microsoft-WindowsEvent-OBO,Microsoft-WindowsFirewall,Microsoft-WireData,Microsoft-WorkloadDiagnosticLogs,Microsoft-WVDAgentHealthStatus,Microsoft-WVDCheckpoints,Microsoft-WVDConnections,Microsoft-WVDErrors,Microsoft-WVDFeeds,Microsoft-WVDManagement,Microsoft-PrometheusMetrics,Microsoft-CommonSecurityLog-Raw,Microsoft-ContainerInsights-Group-Default.",
│         "target": "Properties.DataFlows[1].Streams[0]"
│       }
│     ]
│   }
│ }

[teowa]

Thanks @evandeworp for the efforts to declare this, I am going to add these features in the Azurerm Provider.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.