How can I create a permanent custom table in Azure Monitor Logs for client reference data?

Below is an approach that leverages a custom table for holding your static “client” data so you can join it with your log queries without having to run a daily ingestion process.

Option: Creating a Custom Table

Azure Monitor Logs supports custom tables. You can create one using an administrative control command and then ingest your reference data just once. For example:

KUSTOCopied
.create table ClientReference (NormalId:string, FormalName:string)

Once the table exists, you can ingest your static data via the Data Collector API or other one‐time ingestion methods. The table persists according to its retention settings (which you can configure with table‑level retention settings).

How It Addresses Your Concerns

• One-time Data Ingestion: Instead of running a scheduled job (or repeated SQL), you “seed” the table once.
• Join Operations: You can use the static data table in your queries to join client information with your regular log data. For example:

KUSTOCopied
ClientLogs
| join kind=inner (ClientReference) on $left.ClientId == $right.NormalId
| project ClientId, FormalName, LogDataColumn...

• Retention and Management: Use table management settings to control retention, access, and other aspects. The data will be available as long as your retention policy permits.

Summary

This method lets you create a permanent (custom) table to store static reference data. After ingesting your client mapping data once, you can directly use it to enrich your queries without having to re-send the data every day.

This approach should simplify your workflow, avoid unnecessary daily ingestions, and help you manage your data more effectively.