如何通过ARM模板将Azure活动监视器连接到Log Analytics工作区

Question

如何使用ARM模板将Azure活动日志连接到Log Analytics工作区？我可以通过门户网站连接它：

或者使用powershell。

但我搜索的范围很广，无法找到有关如何使用ARM模板执行此操作的文档（或者目前是否可行）。

我也尝试在azure资源管理器中创建连接并查看资源结构（并通过在PowerShell中获取资源），但在建立连接之前和之后json没有区别

更新：

我尝试了基于this documentation的arm模板部署，我这样应用：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "resources": [
        {
            "name": "my-loganalytics-workspace-name/AzureActivityLog",
            "type": "Microsoft.OperationalInsights/workspaces/dataSources",
            "apiVersion": "2015-11-01-preview",
            "tags": {},
            "properties": {},
            "kind": "AzureActivityLog"
        }
    ]
}

但它部署没有完成（已运行30分钟）并且有一个模糊的错误：

{
    "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxxxxxxx/resourceGroups/my-resource-group/providers/Microsoft.Resources/deployments/template/operations/A886A53AFF9B2E6C",
    "operationId": "A886A53AFF9B2E6C",
    "properties": {
        "provisioningOperation": "Create",
        "provisioningState": "Running",
        "timestamp": "2019-03-25T13:54:32.2320046Z",
        "duration": "PT21M58.8224235S",
        "trackingId": "47915902-f795-482a-a408-de408cd78a30",
        "serviceRequestId": "8c153090-c33d-4819-b9c4-8226df6a861e",
        "statusCode": "InternalServerError",
        "statusMessage": {
            "Message": "An error has occurred."
        },
        "targetResource": {
            "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxxxxxxx/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-log-analytics-workspace/dataSources/AzureActivityLog",
            "resourceType": "Microsoft.OperationalInsights/workspaces/dataSources",
            "resourceName": "my-log-analytics-workspace/AzureActivityLog"
        }
    }
}

Answer 1

是的，可以使用门户网站或PowerShell，如下所述 - > Connecting Azure Activity Log to Log Analytics instance using PowerShell

我使用portal或PowerShell创建了它，并且可以使用PowerShell获取这些详细信息，如下面的屏幕截图所示，其中ResourceId参数显示了资源类型“Microsoft.OperationalInsights / workspaces / dataSources”。

所以很可能它也应该可以通过ARM模板方式实现，因为我看到了资源类型'Microsoft.OperationalInsights / workspaces / dataSources'的ARM模板参考，如下所示 - > https://docs.microsoft.com/en-us/azure/templates/microsoft.operationalinsights/2015-11-01-preview/workspaces/datasources

希望这可以帮助！！干杯！！

Answer 2

我找到了一个工作示例模板here。

所以我的原始模板需要一个不同的名称（必须包含subscriptionId）和linkedResourceId中的properties：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "resources": [
        {
            "name": "[concat('my-loganalytics-workspace-name', '/', subscription().subscriptionId)]",
            "type": "Microsoft.OperationalInsights/workspaces/dataSources",
            "apiVersion": "2015-11-01-preview",
            "tags": {},
            "properties": {
                "linkedResourceId": "[concat(subscription().Id, '/providers/microsoft.insights/eventTypes/management')]"
            },
            "kind": "AzureActivityLog"
        }
    ]
}