Log Analytics collects from log files depends on the source of the log file and the pattern that you specify to structure the data in the log with. Every log entry is an event in the Log Analytics event stream. 

Log Analytics Data

Log Analytics only supports the UTF-8 encoding format.

Event Type: logs

Key (event type identifier): sourceType

These fields are captured by default; you can configure and capture optional data, but these fields are always present:

UI Field NameDescriptionEvents Service Internal Name
pickupTimestampThe timestamp when the Java Agent picked up the event and sent it to the Analytics Agent.pickupTimestamp
MessageThe message body of the log event.message
hostIP address or host name where the event was generated.host
sourceLocation of the logs, usually a path or directory such as /tomcat/logs.source
sourceTypeThe kind of log file, such as apache-httpserver-access-log.sourceType
TimestampTimestamp of the log event.eventTimestamp
Extracted FieldsFields that were extracted using the Controller UI in previous versions appear in the Extracted Fields list. See Collect Log Analytics Data.Varies

You can optionally configure these fields:

Optional FieldsDescription
nodeNameName of the node where the log event occurred.
tierNameName of the tier where the log event occurred.
appNameApplication name where the log event occurred.