Workspace Purge - Purge

  • Reference
Service:
Log Analytics
API Version:
2023-09-01

Purges data in an Log Analytics workspace by a set of user-defined filters.

In order to manage system resources, purge requests are throttled at 50 requests per hour. You should batch the execution of purge requests by sending a single command whose predicate includes all user identities that require purging. Use the in operator to specify multiple identities. You should run the query prior to using for a purge request to verify that the results are expected. Log Analytics only supports purge operations required for compliance with GDPR. The Log Analytics product team reserves the right to reject requests for purge operations that are not for the purpose of GDPR compliance. In the event of a dispute, please create a support ticket

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/purge?api-version=2023-09-01

URI Parameters

Name In Required Type Description
resourceGroupName
 path True

string

The name of the resource group. The name is case insensitive.
subscriptionId
 path True

string

The ID of the target subscription.
workspaceName
 path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version
 query True

string

The API version to use for this operation.

Request Body

Name Required Type Description
filters True

WorkspacePurgeBodyFilters[]

The set of columns and filters (queries) to run over them to purge the resulting data.
table True

string

Table from which to purge data.

Responses

Name Type Description
202 Accepted

WorkspacePurgeResponse

Accepted request for purging an Log Analytics workspace.

Headers

x-ms-status-location: string

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

WorkspacePurge
WorkspacePurgeResourceId

WorkspacePurge

Sample request

POST https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/OIAutoRest5123/providers/Microsoft.OperationalInsights/workspaces/aztest5048/purge?api-version=2023-09-01

{
  "table": "Heartbeat",
  "filters": [
    {
      "column": "TimeGenerated",
      "operator": ">",
      "value": "2017-09-01T00:00:00"
    }
  ]
}

Sample response

Status code:
202 
x-ms-status-location: https://management.azure.com/subscriptions/b96161de-b34a-480f-7343-59b099299283/resourceGroups/example/providers/microsoft.operationalinsights/workspaces/test/operations/purge-970318e7-b859-4edb-8903-83b1b54d0b74?api-version=2023-09-01
{
  "operationId": "7d7cf277-9113-4ab3-8359-d0364b74d01d"
}

WorkspacePurgeResourceId

Sample request

POST https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/OIAutoRest5123/providers/Microsoft.OperationalInsights/workspaces/aztest5048/purge?api-version=2023-09-01

{
  "table": "Heartbeat",
  "filters": [
    {
      "column": "_ResourceId",
      "operator": "==",
      "value": "/subscriptions/12341234-1234-1234-1234-123412341234/resourceGroups/SomeResourceGroup/providers/microsoft.insights/components/AppInsightResource"
    }
  ]
}

Sample response

Status code:
202 
x-ms-status-location: https://management.azure.com/subscriptions/b96161de-b34a-480f-7343-59b099299283/resourceGroups/example/providers/microsoft.operationalinsights/workspaces/test/operations/purge-970318e7-b859-4edb-8903-83b1b54d0b74?api-version=2023-09-01
{
  "operationId": "7d7cf277-9113-4ab3-8359-d0364b74d01d"
}

Definitions

Name Description
WorkspacePurgeBody

Describes the body of a purge request for an App Insights Workspace
WorkspacePurgeBodyFilters

User-defined filters to return data which will be purged from the table.
WorkspacePurgeResponse

Response containing operationId for a specific purge action.

WorkspacePurgeBody

Describes the body of a purge request for an App Insights Workspace

Name Type Description
filters

WorkspacePurgeBodyFilters[]

The set of columns and filters (queries) to run over them to purge the resulting data.
table

string

Table from which to purge data.

WorkspacePurgeBodyFilters

User-defined filters to return data which will be purged from the table.

Name Type Description
column

string

The column of the table over which the given query should run
key

string

When filtering over custom dimensions, this key will be used as the name of the custom dimension.
operator

string

A query operator to evaluate over the provided column and value(s). Supported operators are ==, =~, in, in~, >, >=, <, <=, between, and have the same behavior as they would in a KQL query.
value

the value for the operator to function over. This can be a number (e.g., > 100), a string (timestamp >= '2017-09-01') or array of values.

WorkspacePurgeResponse

Response containing operationId for a specific purge action.

Name Type Description
operationId

string

Id to use when querying for status for a particular purge operation.