AzureFeeds

Log Analytics Export Job is now available in public preview. It gives you a straightforward way to export historical log data from your workspace to Azure Blob Storage, without writing custom scripts or disrupting live operations. You submit a job including a query, time range, and the service handles the rest asynchronously.

Historical data had no built-in exit path

Your Log Analytics workspace accumulates months, sometimes years, of telemetry. That data has real value beyond the workspace: training security models, satisfying compliance requirements, supporting forensic investigations with external tools, or migrating to a new analytics platform. The challenge has always been getting it out.

Log Analytics supports continuous data export for ongoing ingestion, but that doesn’t help with data that already exists. Teams that needed to export historical data had to build their own solutions: scripted query loops, Logic Apps, or Azure Functions calling the query API in batches and stitching results into storage. These approaches were slow, brittle, and hard to operationalize at scale.

Export Job closes that gap.

One job per table, across Analytics and Basic tiers

You target a specific table, define a KQL filter on table, set a time range, and the job exports that data, whether it sits in Analytics or Basic tier, writing the results directly to your storage account as Parquet files.

End-to-end flow of a Log Analytics Export Job

• You can filter with KQL to scope the export to exactly the columns and records you need, reducing cost and downstream processing time.


• Output is gzip-compressed Parquet, the standard columnar format for data lakes, Spark, Azure Data Explorer, and most ML frameworks, with no conversion step required.


• Export data in hourly folders to your blob storage.


• Billing is based on two existing meters: data scanned, using existing Log Analytics scan rates, and data volume exported as measured in your storage account.

Resilient execution

Large exports can be interrupted by network issues, transient storage errors, or downtime. Export Job includes a built-in retry mechanism to overcome these interruptions automatically. The service splits the job into hourly bins, each tracked and written independently to your storage container. Transient failures are retried without any action on your part. If a bin fails after retry exhaustion or job 7-days’ timeout, you can retry it manually within 7 days of job completion, without restarting the entire job or re-exporting data that already completed successfully. Before a retry writes new data, any partial output from the failed bin is automatically cleaned up, so there is no risk of duplicates in your storage account.

Getting started

Log Analytics Export Job is available in public preview today. Configuration is programmatic through the Azure Monitor REST API, letting you create, check status, cancel, and retry jobs. Before your first job:

1. Enable the workspace Managed Identity in your Log Analytics workspace settings.


2. Assign the Storage Blob Data Contributor and Log Analytics Reader roles to the workspace Managed Identity on your destination storage account.


3. Ensure the destination storage account is in the same Azure region as the workspace (cross-region support is on the roadmap).


4. Enable the Jobs category in your workspace’s diagnostic settings, to route job execution records to the LAJobLogs table. This gives you creation time, job parameters, and bin-level status for every job you run.


5. Assess that export volume and run duration using suggested query in export job article.


6. Consider export job bounderies: 
   
   
   
   1. The maximum time range per job is one year
   
   
   2. The maximum run duration per job is seven days. When reached due to volume, you can retry to continue export from where it stopped.
   
   
   3. Five concurrent jobs are supported
   
   
   
   

Once prerequisites are in place, create a job with a single API call:

POST https://api.loganalytics.azure.com/v2/subscriptions/{subscriptionId}/resourcegroups/{resourcegroup}/providers/Microsoft.OperationalInsights/workspaces/{workspace}/jobs/export?api-version=2023-09-01-preview
Authorization: {credential}

content-type: application/json

{

  “startTime”: “2025-01-01T00:00:00Z”,

  “endTime”: “2025-06-30T23:59:59Z”,

  “query”: “{query}”,

  “destinationStorageAccounts”: [

    “/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}”

  ],

  “containerName”: “{containerName}”,

  “outputDataFormat”: “Parquet”,

  “dateTimeFormat”: “yyyy-MM-ddTHH”

}

Copy the job ID returned in the response, which can be used to poll status, cancel, or retry individual failed bins.

Learn more: https://aka.ms/LogsExportJob 

Share your feedback as we continue to improve the feature.