Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
Issue with Creating DCR
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 28.999999999999996%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
Someiah C S
120
Reputation points
We're currently working on ingesting MongoDB Atlas logs into Sentinel using the Log Ingestion API. I’ve written a script that pulls logs from MongoDB and successfully pushes them into a custom table in Log Analytics—it’s working fine so far.
Now, I’m trying to create a Data Collection Rule (DCR) to map the JSON fields to table columns. However, I'm running into an issue: When I attempt to create the DCR after the table is already created, I get the following error: "Classic (MMA-based) custom log tables for stream 'Custom-MongoAccessLogs_CL' with destination 'la--1767074561' are not supported in Data Collection Rules. Please migrate to a Data Collection Rule based table to receive custom logs."
But if I delete the classic table and then try to create the DCR, I run into a different issue: "The specified table: 'MongoAccess_CL' does not exist."
Has anyone faced this before? Any suggestions on how to properly set this up or resolve this conflict between classic and DCR-based tables?
Azure Monitor
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 97%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Suchitra Suregaunkar 170 Reputation points Microsoft External Staff Moderator2025-08-08T07:22:46.8566667+00:00 Hello Someiah C S,
Thank you for posting your query on Microsoft Q&A platform.
Data Collection Rules (DCR) and the Logs Ingestion API only work with DCR-based custom tables.
Classic (MMA-based) tables created via the legacy Custom Log Wizard or HTTP Data Collector API are not supported.
You are seeing the above error due to Creating a DCR for a classic table fails because it’s unsupported and deleting the classic table and trying to create a DCR-based table with the same name may still fail due to retained schema/metadata from the deleted table, causing conflicts.
To resolve this issue here are some mitigation steps:
- Migrate the existing classic table to DCR-based:
You can use the migration API to convert the table in place, keeping the same name and data.
Referral links: https://docs.azure.cn/en-us/azure-monitor/logs/tutorial-logs-ingestion-code? and https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal
- Create a new DCR-based custom table:
You can also use a different table name and point your ingestion process to it.
Create DCR-based custom tables by referring https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal
Additional links:
https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-rule-overviewhttps://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?
Thanks,
Suchitra.
- Migrate the existing classic table to DCR-based:
Sign in to comment
Sign in to answer