After dabbling more and more (because that's a good chunk of what I do on a normal basis for my job), I discovered some documentation that was newer to me, but has been around for a bit. Thanks to the Azure Monitor PM team for the quick assist in making this post a reality!
To start, please reference this Docs article that explains everything in greater detail related to Log Analytics workspace cost (which includes the information about changing the SKU for Log Analytics). That article should be your reference to keep as time unfolds and this space evolves...after all the cloud changes fast.
Customers can switch their legacy SKUs a variety of different ways: via the portal, via ARM Templates, and via something like PowerShell or the AZ-CLI. I made an incorrect assumption in my last post and encouraged someone to reach out and help me tell the tale a bit better (so thankful for the knowledge transfer and share). Since the resource-context switch required leaning on dotted notation to change, I thought the legacy SKUs would as well (and I formed that opinion because they're held in similar spots on the actual resource object, but as I found out, they're manipulated very differently). I tried calling the REST API directly and kept coming up empty.
Now that I've hopefully cleared up any confusion and doubts surrounding the fact that you CAN switch the legacy Log Analytics SKU for existing workspaces, I'll focus the rest of the post on how to make this change in the portal and how to make the change with PowerShell (one of my go-to's for management of Azure resources). If you're curious as to how this would work with say an ARM Template or the AZ-CLI, feel free to drop me a comment or send me a message. I'll experiment and write a future blog post about how to tackle those tasks.
For any existing Log Analytics workspace, locate Usage and estimated costs under General. In the pane that opens to the right, you'll see all Pricing Tiers display. You should also see the expanded SKU that's been configured with a note that says it's the current pricing tier.
Select Pay-as-you-go and click on Select.
When prompted with the Change pricing tier dialogue, select that to officially change the SKU.
You should see the following message once everything has been changed:
To ensure the change took, you should see the new pricing SKU reflected in the portal under Usage and estimated costs.
Switching the SKU around in the portal is one way of handling the change, but you can also do this in a more automated fashion (especially if you have a lot of different workspaces that might have legacy SKUs provisioned). You will change these workspaces by leaning on the Set-AzOperationalInsightsWorkspace cmdlet.
The Set-AzOperationalInsightsWorkspace cmdlet really unlocks the full potential of switching existing SKUs on Log Analytics workspace resources to the perGB SKU without having to provision a brand new Log Analytics workspace resource AND move all existing resources to the new workspace. Of course, you can provision a new Log Analytics workspace resource if you want to and move resources to that brand new workspace, but you don't NEED to.
So what does the code look like? To start, you can accomplish this task in 1 of 2 ways: switch SKUs for all Log Analytics workspaces in 1 subscription to the pergb2018 SKU or switch SKUs for all Log Analytics workspaces across all subscriptions to the pergb2018 SKU.
Code to switch all Log Analytics workspace SKUs in 1 subscription to the pergb2018 SKU:
If you want to copy/paste the code, please reference the script below:
$workspaces = Get-AzResource -ResourceType Microsoft.OperationalInsights/workspaces -ExpandProperties
ForEach($workspace in $workspaces){
Set-AzOperationalInsightsWorkspace -ResourceGroupName $workspace.ResourceGroupName -Name $workspace.Name -Sku pergb2018
}Code to switch all Log Analytics workspace SKUs across all subscriptions to the pergb2018 SKU:
If you want to copy/paste the code, please reference the script below:
$workspaces = Search-AzGraph -Query "where type =~ 'Microsoft.OperationalInsights/workspaces'"
ForEach($workspace in $workspaces){
Set-AzOperationalInsightsWorkspace -ResourceGroupName $workspace.ResourceGroupName -Name $workspace.Name -Sku pergb2018
}After running the commands, whether you're switching all legacy SKUs inside 1 subscription or across all subscriptions, re-run the variable input. What you should see is that each Log Analytics workspace has switched to the pergb2018 SKU.
Here's a screen shot before I ran the commands:
Here's a screen shot after I ran the commands:
As promised, at the end of this series, I'll publish all code in a GitHub repo for you to use going forward as you consolidate and optimize the Log Analytics workspaces within your environment.
Stay tuned!
And as a point of reference, here are the other blogs in this series: