ZTSMetadata

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Reference for ZTSMetadata table in Azure Monitor Logs.

Attribute	Value
Category	Azure Resources, Security
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes
Azure Monitor Tables Reference	View Documentation

Schema (20 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
_ResourceId	string	A unique identifier for the resource that the record is associated with
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
AdditionalInfo	dynamic	NSP and Firewall additional info.
Identifier	string	VM's MAC address.
IP	string	IP address of the VM.
Location	string	Location of the VM.
MessageType	string	Used for control messages like label updates and run control info.
NodeType	string	Type of the node.
ParentResourceId	string	Container resourceId (VMSS).
ResourceTags	dynamic	VM tags.
RunVersion	string	Run version identifier.
Segments	dynamic	Labels/tags for segmentation.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	DateTime rounded by the hour.
Type	string	The name of the table
VNetResourceId	string	VNet resource identifier.
WorkloadResourceId	string	VM resource identifier.

Official Microsoft Learn documentation for field/column information:

This table collects data from the following Azure resource types:

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊