Data Collection

def create(resource_group_name: str, data_collection_rule_name: str, body: Optional[DataCollectionRuleResource] = None, **kwargs: Any) -> DataCollectionRuleResource:
    """
    Creates or updates a data collection rule.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_rule_name: str - Name of the data collection rule
    - body: Optional[DataCollectionRuleResource] - Data collection rule configuration
    
    Returns:
    DataCollectionRuleResource - The created data collection rule
    """

def get(resource_group_name: str, data_collection_rule_name: str, **kwargs: Any) -> DataCollectionRuleResource:
    """
    Returns the specified data collection rule.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_rule_name: str - Name of the data collection rule
    
    Returns:
    DataCollectionRuleResource - The data collection rule details
    """

def delete(resource_group_name: str, data_collection_rule_name: str, **kwargs: Any) -> None:
    """
    Deletes a data collection rule.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_rule_name: str - Name of the data collection rule
    """

def update(resource_group_name: str, data_collection_rule_name: str, body: Optional[ResourceForUpdate] = None, **kwargs: Any) -> DataCollectionRuleResource:
    """
    Updates part of a data collection rule.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_rule_name: str - Name of the data collection rule
    - body: Optional[ResourceForUpdate] - Properties to update
    
    Returns:
    DataCollectionRuleResource - The updated data collection rule
    """

def list_by_resource_group(resource_group_name: str, **kwargs: Any) -> ItemPaged[DataCollectionRuleResource]:
    """
    Lists all data collection rules in the specified resource group.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    
    Returns:
    ItemPaged[DataCollectionRuleResource] - List of data collection rules
    """

def list_by_subscription(**kwargs: Any) -> ItemPaged[DataCollectionRuleResource]:
    """
    Lists all data collection rules in the specified subscription.
    
    Returns:
    ItemPaged[DataCollectionRuleResource] - List of data collection rules
    """

def create(resource_group_name: str, data_collection_endpoint_name: str, body: Optional[DataCollectionEndpointResource] = None, **kwargs: Any) -> DataCollectionEndpointResource:
    """
    Creates or updates a data collection endpoint.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_endpoint_name: str - Name of the data collection endpoint
    - body: Optional[DataCollectionEndpointResource] - Endpoint configuration
    
    Returns:
    DataCollectionEndpointResource - The created endpoint
    """

def get(resource_group_name: str, data_collection_endpoint_name: str, **kwargs: Any) -> DataCollectionEndpointResource:
    """
    Returns the specified data collection endpoint.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_endpoint_name: str - Name of the data collection endpoint
    
    Returns:
    DataCollectionEndpointResource - The endpoint details
    """

def delete(resource_group_name: str, data_collection_endpoint_name: str, **kwargs: Any) -> None:
    """
    Deletes a data collection endpoint.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_endpoint_name: str - Name of the data collection endpoint
    """

def list_by_resource_group(resource_group_name: str, **kwargs: Any) -> ItemPaged[DataCollectionEndpointResource]:
    """
    Lists all data collection endpoints in the specified resource group.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    
    Returns:
    ItemPaged[DataCollectionEndpointResource] - List of endpoints
    """

def list_by_subscription(**kwargs: Any) -> ItemPaged[DataCollectionEndpointResource]:
    """
    Lists all data collection endpoints in the specified subscription.
    
    Returns:
    ItemPaged[DataCollectionEndpointResource] - List of endpoints
    """

def create(resource_uri: str, association_name: str, body: Optional[DataCollectionRuleAssociationProxyOnlyResource] = None, **kwargs: Any) -> DataCollectionRuleAssociationProxyOnlyResource:
    """
    Creates or updates an association between a resource and a data collection rule.
    
    Parameters:
    - resource_uri: str - Full resource ID of the target resource
    - association_name: str - Name of the association
    - body: Optional[DataCollectionRuleAssociationProxyOnlyResource] - Association configuration
    
    Returns:
    DataCollectionRuleAssociationProxyOnlyResource - The created association
    """

def get(resource_uri: str, association_name: str, **kwargs: Any) -> DataCollectionRuleAssociationProxyOnlyResource:
    """
    Returns the specified association between a resource and a data collection rule.
    
    Parameters:
    - resource_uri: str - Full resource ID of the target resource
    - association_name: str - Name of the association
    
    Returns:
    DataCollectionRuleAssociationProxyOnlyResource - The association details
    """

def delete(resource_uri: str, association_name: str, **kwargs: Any) -> None:
    """
    Deletes an association between a resource and a data collection rule.
    
    Parameters:
    - resource_uri: str - Full resource ID of the target resource
    - association_name: str - Name of the association
    """

def list_by_resource(resource_uri: str, **kwargs: Any) -> ItemPaged[DataCollectionRuleAssociationProxyOnlyResource]:
    """
    Lists associations for the specified resource.
    
    Parameters:
    - resource_uri: str - Full resource ID of the target resource
    
    Returns:
    ItemPaged[DataCollectionRuleAssociationProxyOnlyResource] - List of associations
    """

def list_by_rule(resource_group_name: str, data_collection_rule_name: str, **kwargs: Any) -> ItemPaged[DataCollectionRuleAssociationProxyOnlyResource]:
    """
    Lists associations for the specified data collection rule.
    
    Parameters:
    - resource_group_name: str - Name of the resource group
    - data_collection_rule_name: str - Name of the data collection rule
    
    Returns:
    ItemPaged[DataCollectionRuleAssociationProxyOnlyResource] - List of associations
    """

from azure.mgmt.monitor.models import (
    DataCollectionRuleResource, DataCollectionRuleDataSources,
    DataCollectionRuleDestinations, WindowsEventLogDataSource,
    LogAnalyticsDestination, DataFlow
)

# Define Windows Event Log data source
windows_events = WindowsEventLogDataSource(
    name="WindowsEventLogsDataSource",
    streams=["Microsoft-Event"],
    x_path_queries=[
        "Application!*[System[(Level=1 or Level=2 or Level=3)]]",
        "System!*[System[(Level=1 or Level=2 or Level=3)]]"
    ]
)

# Define data sources
data_sources = DataCollectionRuleDataSources(
    windows_event_logs=[windows_events]
)

# Define destination (Log Analytics workspace)
log_analytics_destination = LogAnalyticsDestination(
    workspace_resource_id=f"/subscriptions/{subscription_id}/resourceGroups/monitoring-rg/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
    name="LogAnalyticsDestination"
)

destinations = DataCollectionRuleDestinations(
    log_analytics=[log_analytics_destination]
)

# Define data flow
data_flow = DataFlow(
    streams=["Microsoft-Event"],
    destinations=["LogAnalyticsDestination"],
    transform_kql="source | where EventLevelName == 'Error'"  # Optional KQL transform
)

# Create data collection rule
dcr = DataCollectionRuleResource(
    location="East US",
    data_sources=data_sources,
    destinations=destinations,
    data_flows=[data_flow],
    description="Collect Windows Event Logs with error filtering"
)

result = client.data_collection_rules.create(
    resource_group_name="monitoring-rg",
    data_collection_rule_name="windows-events-dcr",
    body=dcr
)

from azure.mgmt.monitor.models import (
    DataCollectionEndpointResource, DataCollectionEndpointLogsIngestion,
    DataCollectionEndpointConfigurationAccess, NetworkRuleSet
)

# Define network access rules
network_acls = NetworkRuleSet(
    public_network_access="Enabled"
)

# Define logs ingestion configuration
logs_ingestion = DataCollectionEndpointLogsIngestion(
    endpoint="https://my-dce.eastus-1.ingest.monitor.azure.com"
)

# Define configuration access
configuration_access = DataCollectionEndpointConfigurationAccess(
    endpoint="https://my-dce.eastus-1.handler.control.monitor.azure.com"
)

# Create data collection endpoint
dce = DataCollectionEndpointResource(
    location="East US",
    network_acls=network_acls,
    logs_ingestion=logs_ingestion,
    configuration_access=configuration_access,
    description="Data collection endpoint for custom logs"
)

endpoint_result = client.data_collection_endpoints.create(
    resource_group_name="monitoring-rg",
    data_collection_endpoint_name="my-data-endpoint",
    body=dce
)

from azure.mgmt.monitor.models import DataCollectionRuleAssociationProxyOnlyResource

# Create association between VM and data collection rule
vm_resource_id = f"/subscriptions/{subscription_id}/resourceGroups/compute-rg/providers/Microsoft.Compute/virtualMachines/web-server"

association = DataCollectionRuleAssociationProxyOnlyResource(
    data_collection_rule_id=result.id,
    description="Associate Windows events DCR with web server VM"
)

association_result = client.data_collection_rule_associations.create(
    resource_uri=vm_resource_id,
    association_name="windows-events-association",
    body=association
)

print(f"Association created: {association_result.id}")

from azure.mgmt.monitor.models import (
    LogFilesDataSource, LogFileSettings, LogFileSettingsText,
    StorageBlob, StorageBlobDestination
)

# Define custom log file data source
log_file_source = LogFilesDataSource(
    name="CustomAppLogs",
    streams=["Custom-AppLogs"],
    file_patterns=["/var/log/myapp/*.log"],
    format="text",
    settings=LogFileSettings(
        text=LogFileSettingsText(
            record_start_timestamp_format="yyyy-MM-dd HH:mm:ss"
        )
    )
)

# Define storage destination for raw logs
storage_destination = StorageBlobDestination(
    storage_account_resource_id=f"/subscriptions/{subscription_id}/resourceGroups/storage-rg/providers/Microsoft.Storage/storageAccounts/logstorage",
    container_name="custom-logs",
    name="StorageDestination"
)

# Create custom logs DCR
custom_dcr = DataCollectionRuleResource(
    location="East US",
    data_sources=DataCollectionRuleDataSources(
        log_files=[log_file_source]
    ),
    destinations=DataCollectionRuleDestinations(
        storage_blobs=[storage_destination]
    ),
    data_flows=[
        DataFlow(
            streams=["Custom-AppLogs"],
            destinations=["StorageDestination"]
        )
    ]
)

class DataCollectionRuleResource:
    """Data collection rule resource."""
    location: str  # Resource location
    data_sources: Optional[DataCollectionRuleDataSources]  # Data sources configuration
    destinations: Optional[DataCollectionRuleDestinations]  # Destinations configuration
    data_flows: Optional[List[DataFlow]]  # Data flow definitions
    description: Optional[str]  # Rule description
    data_collection_endpoint_id: Optional[str]  # Associated endpoint ID
    stream_declarations: Optional[Dict[str, StreamDeclaration]]  # Custom stream definitions

class DataCollectionRuleDataSources:
    """Data sources configuration."""
    performance_counters: Optional[List[PerfCounterDataSource]]  # Performance counters
    windows_event_logs: Optional[List[WindowsEventLogDataSource]]  # Windows events
    syslog: Optional[List[SyslogDataSource]]  # Syslog data
    log_files: Optional[List[LogFilesDataSource]]  # Custom log files
    extensions: Optional[List[ExtensionDataSource]]  # Extension data sources
    iis_logs: Optional[List[IisLogsDataSource]]  # IIS logs
    platform_telemetry: Optional[List[PlatformTelemetryDataSource]]  # Platform telemetry

class DataCollectionRuleDestinations:
    """Destinations configuration."""
    log_analytics: Optional[List[LogAnalyticsDestination]]  # Log Analytics workspaces
    azure_monitor_metrics: Optional[AzureMonitorMetricsDestination]  # Azure Monitor metrics
    storage_blobs: Optional[List[StorageBlobDestination]]  # Storage blob destinations
    event_hubs: Optional[List[EventHubDestination]]  # Event Hub destinations
    event_hubs_direct: Optional[List[EventHubDirectDestination]]  # Direct Event Hub

class DataFlow:
    """Data flow definition."""
    streams: List[str]  # Source streams
    destinations: List[str]  # Target destinations
    transform_kql: Optional[str]  # KQL transformation query
    output_stream: Optional[str]  # Output stream name

class DataCollectionEndpointResource:
    """Data collection endpoint resource."""
    location: str  # Resource location
    description: Optional[str]  # Endpoint description
    immutable_id: Optional[str]  # Immutable endpoint identifier
    configuration_access: Optional[DataCollectionEndpointConfigurationAccess]  # Configuration access
    logs_ingestion: Optional[DataCollectionEndpointLogsIngestion]  # Logs ingestion
    metrics_ingestion: Optional[DataCollectionEndpointMetricsIngestion]  # Metrics ingestion
    network_acls: Optional[DataCollectionEndpointNetworkAcls]  # Network access rules
    private_link_scoped_resources: Optional[List[PrivateLinkScopedResource]]  # Private link resources

class WindowsEventLogDataSource:
    """Windows Event Log data source."""
    name: str  # Data source name
    streams: List[str]  # Output streams
    x_path_queries: List[str]  # XPath queries for event selection

class LogAnalyticsDestination:
    """Log Analytics workspace destination."""
    workspace_resource_id: str  # Workspace resource ID
    name: str  # Destination name

class DataCollectionRuleAssociationProxyOnlyResource:
    """Data collection rule association."""
    data_collection_rule_id: Optional[str]  # Data collection rule ID
    data_collection_endpoint_id: Optional[str]  # Data collection endpoint ID
    description: Optional[str]  # Association description

class PerfCounterDataSource:
    """Performance counter data source."""
    name: str  # Data source name
    streams: List[str]  # Output streams
    counter_specifiers: List[str]  # Performance counters to collect
    sampling_frequency_in_seconds: int  # Sampling frequency

class SyslogDataSource:
    """Syslog data source."""
    name: str  # Data source name  
    streams: List[str]  # Output streams
    facility_names: List[str]  # Syslog facilities
    log_levels: List[str]  # Log levels to collect

class LogFilesDataSource:
    """Log files data source."""
    name: str  # Data source name
    streams: List[str]  # Output streams
    file_patterns: List[str]  # File path patterns
    format: str  # Log format (text/json)
    settings: Optional[LogFileSettings]  # Format-specific settings