Logs Ingestion API / DCR cannot bind custom stream to valid table

Paul Brettle 0 Reputation points
2025-08-11T23:07:41.5766667+00:00

We are configuring a custom integration using Microsoft Sentinel's Logs Ingestion API and a custom DCR (test-dcr-shell) in region westus2. We are attempting to bind the stream Custom-ClassificationStream to a custom table CustomClassificationStream_CL, created in the Log Analytics workspace DSPMSentinel.

  • The table exists and has tableSubType: DataCollectionRuleBased
  • The schema exactly matches the stream definition in the DCR
  • The DCR is correctly deployed using az rest --method put
  • The DCR stream declaration and data flow routing are valid
  • Yet, the PUT fails with:

{

"code": "InvalidOutputTable",

"message": "Table for output stream 'Custom-CyeraClassificationStream' is not available..."

}

This issue persists even after waiting >15 minutes after table creation.

It seems that the validator rejects the DCR due to a missing table, which clearly exists. The result fom the az rest put is as follows:

Bad Request({"error":{"code":"InvalidPayload","message":"Data collection rule is invalid","details":[{"code":"InvalidOutputTable","message":"Table for output stream 'Custom-ClassificationStream' is not available for destination 'la--1249775715'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.","target":"properties.dataFlows[1]"},{"code":"InvalidOutputTable","message":"Custom table for stream 'Custom-ClassificationStream' is not available for destination 'la--1249775715'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.","target":"properties.dataFlows[1]"}]}})

I can confirm that the correct table does exist and Sentinel does show the table and hence should be able to be bound. Any help would be recommended. I am struggling to get these working and keep getting roadblocks.

Azure App Configuration
Azure App Configuration
An Azure service that provides hosted, universal storage for Azure app configurations.
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.