Logs Ingestion API / DCR cannot bind custom stream to valid table
We are configuring a custom integration using Microsoft Sentinel's Logs Ingestion API and a custom DCR (test-dcr-shell
) in region westus2
. We are attempting to bind the stream Custom-ClassificationStream
to a custom table CustomClassificationStream_CL
, created in the Log Analytics workspace DSPMSentinel
.
- The table exists and has
tableSubType: DataCollectionRuleBased
- The schema exactly matches the stream definition in the DCR
- The DCR is correctly deployed using
az rest --method put
- The DCR stream declaration and data flow routing are valid
- Yet, the
PUT
fails with:
{
"code": "InvalidOutputTable",
"message": "Table for output stream 'Custom-CyeraClassificationStream' is not available..."
}
This issue persists even after waiting >15 minutes after table creation.
It seems that the validator rejects the DCR due to a missing table, which clearly exists. The result fom the az rest put is as follows:
Bad Request({"error":{"code":"InvalidPayload","message":"Data collection rule is invalid","details":[{"code":"InvalidOutputTable","message":"Table for output stream 'Custom-ClassificationStream' is not available for destination 'la--1249775715'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.","target":"properties.dataFlows[1]"},{"code":"InvalidOutputTable","message":"Custom table for stream 'Custom-ClassificationStream' is not available for destination 'la--1249775715'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.","target":"properties.dataFlows[1]"}]}})
I can confirm that the correct table does exist and Sentinel does show the table and hence should be able to be bound. Any help would be recommended. I am struggling to get these working and keep getting roadblocks.