Share via

Issue with Creating DCR

Someiah C S 140 Reputation points
2025-08-07T06:58:23.38+00:00

We're currently working on ingesting MongoDB Atlas logs into Sentinel using the Log Ingestion API. I’ve written a script that pulls logs from MongoDB and successfully pushes them into a custom table in Log Analytics—it’s working fine so far.

Now, I’m trying to create a Data Collection Rule (DCR) to map the JSON fields to table columns. However, I'm running into an issue: When I attempt to create the DCR after the table is already created, I get the following error: "Classic (MMA-based) custom log tables for stream 'Custom-MongoAccessLogs_CL' with destination 'la--1767074561' are not supported in Data Collection Rules. Please migrate to a Data Collection Rule based table to receive custom logs."

But if I delete the classic table and then try to create the DCR, I run into a different issue: "The specified table: 'MongoAccess_CL' does not exist."

Has anyone faced this before? Any suggestions on how to properly set this up or resolve this conflict between classic and DCR-based tables?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
0 comments
Accepted answer
  1. Suchitra Suregaunkar 340 Reputation points Microsoft External Staff Moderator
    2025-08-08T07:22:46.8566667+00:00

    Hello Someiah C S,

    Thank you for posting your query on Microsoft Q&A platform.

    Data Collection Rules (DCR) and the Logs Ingestion API only work with DCR-based custom tables.

    Classic (MMA-based) tables created via the legacy Custom Log Wizard or HTTP Data Collector API are not supported.

    You are seeing the above error due to Creating a DCR for a classic table fails because it’s unsupported and deleting the classic table and trying to create a DCR-based table with the same name may still fail due to retained schema/metadata from the deleted table, causing conflicts.

    To resolve this issue here are some mitigation steps:

    1. Migrate the existing classic table to DCR-based:
      You can use the migration API to convert the table in place, keeping the same name and data.

    Referral links: https://docs.azure.cn/en-us/azure-monitor/logs/tutorial-logs-ingestion-code? and https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal

    1. Create a new DCR-based custom table:

    You can also use a different table name and point your ingestion process to it.

    Create DCR-based custom tables by referring https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal

    Additional links:
    https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-rule-overview

    https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?

    Thanks,

    Suchitra.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.