How can I connect Log Analytics Workspace via rest api with Azure Data Factory without Authentication

Question

I want to retrieve data from the result of a query in Log analytics workspace, I tried to do that using pipeline, where as the first function I got the Web activity, configured as follows:

I followed this example:https://datasavvy.me/2020/12/24/retrieving-log-analytics-data-with-data-factory/ Then I got Copy data activity: request method: post request body:

{
    "query": "ADFPipelineRun | project PipelineName, Status,TimeGenerated,  _ResourceId, Type | where Status == 'Succeeded'"
}| ConvertTo-Json

two headers: Content-Type: application/json; charset=utf-8 Authentication: @concat('Bearer ', activity('GetBearerToken').output.access_token)

I get this error when I debugged:

Answer 1

To connect Log Analytics Workspace via rest api with Azure Data Factory without Authentication.

First you need to get a bearer token, which gives you the authorization to execute the query. To get this follow below steps:

• Create an Azure AD App in Azure Active Directory and note down the tenant Id, Client Id and client secret. (In your workspace grant IAM privileges to the AAD Application you created as Contributor) Now in ADF Create a pipeline and take web activity to get bearer token.

URL: https://login.microsoftonline.com/<Apps_tenant_ID>/oauth2/token Method: POST Body: grant_type=client_credentials &client_id=<Apps_Client_ID>&resource=https://api.loganalytics.io/&client_secret=<Apps_Client_Secret> Header : "Content-Type: application/x-www-form-urlencoded"

Bearer token:

• To query Log analytics from Rest API. create a linked service for Rest API with below settings.

Base URL: https://api.loganalytics.io/v1/workspaces/<Workspace_Id>/query

Source settings:

Request method: POST Request Body: {"query": "search * | where PipelineName contains 'pipe'"} Headers: "Content-Type:application/json" "Authorization: @concat('Bearer ',activity('Web2').output.access_token)"

• Add appropriate SINK and run the pipeline.