[Monitor] az monitor log-analytics workspace table: Add new command create, delete and search-job create to support Microsoft/Custom log/Search Results table operations, az monitor log-analytics workspace update: Add a new parameter --data-collection-rule to support update defaultDataCollectionRuleResourceId

src/azure-cli/azure/cli/command_modules/acr/tests/latest/recordings/test_acr_create_with_audits.yaml

@@ -62,7 +62,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.31.0 azsdk-python-mgmt-loganalytics/11.0.0 Python/3.8.2 (Linux-5.10.60.1-microsoft-standard-WSL2-x86_64-with-glibc2.29)
     method: PUT
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest.rg000001/providers/Microsoft.OperationalInsights/workspaces/wprkspace000003?api-version=2021-06-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest.rg000001/providers/Microsoft.OperationalInsights/workspaces/wprkspace000003?api-version=2021-12-01-preview
   response:
     body:
       string: "{\r\n  \"properties\": {\r\n    \"source\": \"Azure\",\r\n    \"customerId\":
@@ -121,7 +121,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.31.0 azsdk-python-mgmt-loganalytics/11.0.0 Python/3.8.2 (Linux-5.10.60.1-microsoft-standard-WSL2-x86_64-with-glibc2.29)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest.rg000001/providers/Microsoft.OperationalInsights/workspaces/wprkspace000003?api-version=2021-06-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest.rg000001/providers/Microsoft.OperationalInsights/workspaces/wprkspace000003?api-version=2021-12-01-preview
   response:
     body:
       string: "{\r\n  \"properties\": {\r\n    \"source\": \"Azure\",\r\n    \"customerId\":

src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_create_with_custom_monitoring_workspace.yaml

@@ -62,7 +62,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.32.0 azsdk-python-mgmt-loganalytics/12.0.0 Python/3.8.10 (Linux-5.11.0-1027-azure-x86_64-with-glibc2.29)
     method: PUT
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.OperationalInsights/workspaces/cliaksworkspace000003?api-version=2021-06-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.OperationalInsights/workspaces/cliaksworkspace000003?api-version=2021-12-01-preview
   response:
     body:
       string: "{\r\n  \"properties\": {\r\n    \"source\": \"Azure\",\r\n    \"customerId\":
@@ -121,7 +121,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.32.0 azsdk-python-mgmt-loganalytics/12.0.0 Python/3.8.10 (Linux-5.11.0-1027-azure-x86_64-with-glibc2.29)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.OperationalInsights/workspaces/cliaksworkspace000003?api-version=2021-06-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.OperationalInsights/workspaces/cliaksworkspace000003?api-version=2021-12-01-preview
   response:
     body:
       string: "{\r\n  \"properties\": {\r\n    \"source\": \"Azure\",\r\n    \"customerId\":

src/azure-cli/azure/cli/command_modules/hdinsight/tests/latest/recordings/test_hdinsight_azure_monitor.yaml

@@ -271,7 +271,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.29.0 azsdk-python-azure-mgmt-resource/19.0.0 Python/3.7.2 (Windows-10-10.0.19041-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/hdicli-000001/providers/Microsoft.OperationalInsights/workspaces/testws000003?api-version=2021-06-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/hdicli-000001/providers/Microsoft.OperationalInsights/workspaces/testws000003?api-version=2021-12-01-preview
   response:
     body:
       string: "{\r\n  \"properties\": {\r\n    \"source\": \"Azure\",\r\n    \"customerId\":

src/azure-cli/azure/cli/command_modules/hdinsight/tests/latest/recordings/test_hdinsight_monitor.yaml

@@ -2964,7 +2964,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.29.0 azsdk-python-mgmt-loganalytics/11.0.0 Python/3.7.2 (Windows-10-10.0.19041-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/hdicli-000001/providers/Microsoft.OperationalInsights/workspaces/testws000003?api-version=2021-06-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/hdicli-000001/providers/Microsoft.OperationalInsights/workspaces/testws000003?api-version=2021-12-01-preview
   response:
     body:
       string: "{\r\n  \"properties\": {\r\n    \"source\": \"Azure\",\r\n    \"customerId\":

src/azure-cli/azure/cli/command_modules/monitor/_help.py

@@ -1113,15 +1113,56 @@
         az monitor log-analytics workspace table show --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable
 """
 
+helps['monitor log-analytics workspace table create'] = """
+type: command
+short-summary: Create a Log Analytics workspace microsoft/custom log table. The table name needs to end with '_CL'.
+examples:
+  - name: Create a Log Analytics workspace custom log table.
+    text: |
+        az monitor log-analytics workspace table create --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable_CL --retention-time 45 --columns MyColumn1=string TimeGenerated=datetime
+"""
+
+helps['monitor log-analytics workspace table search-job'] = """
+type: group
+short-summary: Manage tables for log analytics workspace search results table.
+"""
+
+helps['monitor log-analytics workspace table search-job create'] = """
+type: command
+short-summary: Create a Log Analytics workspace search results table. The table name needs to end with '_SRCH'.
+examples:
+  - name: Create a Log Analytics workspace search result table.
+    text: |
+        az monitor log-analytics workspace table search-job create --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable_SRCH --retention-time 45 --search-query "Heartbeat | where SourceSystem != '' | project SourceSystem" --limit 1000 --start-search-time "Sat, 28 Aug 2021 05:29:18 GMT" --end-search-time "Sat, 28 Aug 2021 08:29:18 GMT"
+"""
+
+
 helps['monitor log-analytics workspace table update'] = """
 type: command
-short-summary: Update the properties of a Log Analytics workspace table, currently only support updating retention time.
+short-summary: Update the properties of a Log Analytics workspace table.
 examples:
-  - name: Update the retention time of a Log Analytics workspace table
+  - name: Update the properties of a Log Analytics workspace table.
     text: |
         az monitor log-analytics workspace table update --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable --retention-time 30
 """
 
+helps['monitor log-analytics workspace table delete'] = """
+type: command
+short-summary: Delete a Log Analytics workspace table.
+examples:
+  - name: Delete a Log Analytics workspace table.
+    text: |
+        az monitor log-analytics workspace table delete --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable
+"""
+
+helps['monitor log-analytics workspace table wait'] = """
+type: command
+short-summary: Place the CLI in a waiting state until a condition of the workspace table is met.
+examples:
+  - name: Pause executing next line of CLI script until the workspace table is successfully provisioned.
+    text: az monitor log-analytics workspace table wait -n MyTable -g MyResourceGroup --workspace-name MyWorkspace --created
+"""
+
 helps['monitor log-analytics workspace pack'] = """
 type: group
 short-summary: Manage intelligent packs for log analytics workspace.
@@ -1170,6 +1211,9 @@
     text: |
         az monitor log-analytics workspace update --resource-group myresourcegroup --retention-time 30 --workspace-name myworkspace
     crafted: true
+  - name: Update the defaultDataCollectionRuleResourceId of the workspace
+    text: |
+        az monitor log-analytics workspace update --resource-group myresourcegroup --workspace-name myworkspace --data-collection-rule "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}".
 """
 
 helps['monitor log-analytics workspace linked-service'] = """

src/azure-cli/azure/cli/command_modules/monitor/_params.py

@@ -416,6 +416,9 @@ def load_arguments(self, _):
                    arg_type=get_enum_type(PublicNetworkAccessType))
         c.argument('force', options_list=['--force', '-f'], arg_type=get_three_state_flag())
 
+    with self.argument_context('monitor log-analytics workspace update') as c:
+        c.argument('default_data_collection_rule_resource_id', options_list='--data-collection-rule', help='The resource ID of the default Data Collection Rule to use for this workspace. Expected format is /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.')
+
     with self.argument_context('monitor log-analytics workspace pack') as c:
         c.argument('intelligence_pack_name', options_list=['--name', '-n'])
         c.argument('workspace_name', options_list='--workspace-name')
@@ -440,7 +443,26 @@ def load_arguments(self, _):
     with self.argument_context('monitor log-analytics workspace table') as c:
         c.argument('table_name', name_arg_type, help='Name of the table.')
         c.argument('workspace_name', options_list='--workspace-name')
-        c.argument('retention_in_days', options_list='--retention-time', help='The data table data retention in days, between 30 and 730. Setting this property to null will default to the workspace', type=int, required=True)
+        c.argument('retention_in_days', type=int, options_list='--retention-time', help='The data table data retention in days, between 30 and 730. Setting this property to null will default to the workspace')
+        c.argument('total_retention_in_days', type=int, options_list='--total-retention-time', help='The table data total retention in days, between 4 and 2555. Setting this property to null will default to table retention.')
+
+    with self.argument_context('monitor log-analytics workspace table create') as c:
+        from azure.mgmt.loganalytics.models import TablePlanEnum
+        c.argument('columns', nargs='+', help='A list of table custom columns.Extracts multiple space-separated colunms in colunm_name=colunm_type format')
+        c.argument('plan', arg_type=get_enum_type(TablePlanEnum), help='The table plan. Possible values include: "Basic", "Analytics".')
+        c.argument('description', help='Schema description.')
+
+    with self.argument_context('monitor log-analytics workspace table search-job create') as c:
+        c.argument('search_query', options_list=['--search-query'], help='Search job query.')
+        c.argument('limit', type=int, help='Limit the search job to return up to specified number of rows.')
+        c.argument('start_search_time', arg_type=get_datetime_type(help='Datetime format.'))
+        c.argument('end_search_time', arg_type=get_datetime_type(help='Datetime format.'))
+
+    with self.argument_context('monitor log-analytics workspace table update') as c:
+        from azure.mgmt.loganalytics.models import TablePlanEnum
+        c.argument('columns', nargs='+', help='A list of table custom columns.Extracts multiple space-separated colunms in colunm_name=colunm_type format')
+        c.argument('plan', arg_type=get_enum_type(TablePlanEnum), help='The table plan. Possible values include: "Basic", "Analytics".')
+        c.argument('description', help='Table description.')
     # endregion
 
     # region Log Analytics Workspace Data Export

src/azure-cli/azure/cli/command_modules/monitor/commands.py

@@ -387,10 +387,16 @@ def load_command_table(self, _):
         g.command('list-management-groups', 'list', command_type=log_analytics_workspace_management_groups_sdk)
         g.command('get-shared-keys', 'get_shared_keys', command_type=log_analytics_workspace_shared_keys_sdk)
 
-    with self.command_group('monitor log-analytics workspace table', log_analytics_workspace_table_sdk, custom_command_type=log_analytics_workspace_custom, client_factory=cf_log_analytics_workspace_tables) as g:
+    with self.command_group('monitor log-analytics workspace table', log_analytics_workspace_table_sdk, custom_command_type=log_analytics_workspace_custom, client_factory=cf_log_analytics_workspace_tables, is_preview=True) as g:
         g.command('list', 'list_by_workspace')
         g.show_command('show', 'get')
-        g.custom_command('update', 'update_log_analytics_workspace_table')
+        g.custom_command('create', 'create_log_analytics_workspace_table', supports_no_wait=True)
+        g.custom_command('update', 'update_log_analytics_workspace_table', supports_no_wait=True)
+        g.command('delete', 'begin_delete', supports_no_wait=True, confirmation=True)
+        g.wait_command('wait')
+
+    with self.command_group('monitor log-analytics workspace table search-job', log_analytics_workspace_table_sdk, custom_command_type=log_analytics_workspace_custom, client_factory=cf_log_analytics_workspace_tables, is_preview=True) as g:
+        g.custom_command('create', 'create_log_analytics_workspace_table_search_job', supports_no_wait=True)
 
     with self.command_group('monitor log-analytics workspace data-export', log_analytics_workspace_data_exports_sdk,
                             custom_command_type=log_analytics_workspace_custom) as g:

src/azure-cli/azure/cli/command_modules/monitor/operations/log_analytics_workspace.py

@@ -4,8 +4,10 @@
 # --------------------------------------------------------------------------------------------
 from azure.cli.command_modules.monitor._client_factory import _log_analytics_client_factory
 from azure.cli.core.commands.transform import _parse_id
-from azure.mgmt.loganalytics.models import WorkspaceSkuNameEnum, Workspace, WorkspaceSku, WorkspaceCapping, Table
+from azure.mgmt.loganalytics.models import WorkspaceSkuNameEnum, Workspace, WorkspaceSku, WorkspaceCapping, Table,\
+    Schema, Column, SearchResults, ColumnTypeEnum
 from azure.cli.core.util import sdk_no_wait
+from azure.cli.core.azclierror import ArgumentUsageError, InvalidArgumentValueError, RequiredArgumentMissingError
 from knack.util import CLIError
 
 
@@ -35,7 +37,8 @@ def create_log_analytics_workspace(client, resource_group_name, workspace_name,
 
 def update_log_analytics_workspace(instance, tags=None, capacity_reservation_level=None,
                                    retention_time=None, daily_quota_gb=None,
-                                   public_network_access_for_query=None, public_network_access_for_ingestion=None):
+                                   public_network_access_for_query=None, public_network_access_for_ingestion=None,
+                                   default_data_collection_rule_resource_id=None):
     if tags is not None:
         instance.tags = tags
     if capacity_reservation_level is not None:
@@ -50,6 +53,8 @@ def update_log_analytics_workspace(instance, tags=None, capacity_reservation_lev
         instance.public_network_access_for_query = public_network_access_for_query
     if public_network_access_for_ingestion is not None:
         instance.public_network_access_for_ingestion = public_network_access_for_ingestion
+    if default_data_collection_rule_resource_id is not None:
+        instance.default_data_collection_rule_resource_id = default_data_collection_rule_resource_id
     return instance
 
 
@@ -142,9 +147,73 @@ def update_log_analytics_workspace_data_exports(cmd, instance, table_names, dest
     return instance
 
 
-def update_log_analytics_workspace_table(client, resource_group_name, workspace_name, table_name, retention_in_days):
-    table = Table(retention_in_days=retention_in_days)
-    return client.update(resource_group_name=resource_group_name,
-                         workspace_name=workspace_name,
-                         table_name=table_name,
-                         parameters=table)
+# pylint:disable=too-many-locals dangerous-default-value
+def create_log_analytics_workspace_table(client, resource_group_name, workspace_name, table_name, columns=[],
+                                         retention_in_days=None, total_retention_in_days=None, plan=None,
+                                         description=None, no_wait=False):
+    if retention_in_days and total_retention_in_days:
+        if total_retention_in_days < retention_in_days:
+            InvalidArgumentValueError('InvalidArgumentValueError: The specified value of --retention-time'
+                                      ' should be less than --total-retention-time')
+    columns_list = [] if columns else None
+    for col in columns:
+        if '=' in col:
+            n, t = col.split('=', 1)
+            if t.lower() not in [x.value.lower() for x in ColumnTypeEnum]:
+                raise InvalidArgumentValueError('InvalidArgumentValueError: "{}" is not a valid value for type_name. '
+                                                'Allowed values: string, int, long, real, boolean, dateTime, guid, '
+                                                'dynamic".'.format(t))
+        else:
+            raise ArgumentUsageError('Usage error: --columns should be provided in colunm_name=colunm_type format')
+        columns_list.append(Column(name=n, type=t))
+    schema = None
+    if columns or description is not None:
+        if not columns:
+            raise RequiredArgumentMissingError('Usage error: When using --description, --columns must be provided')
+        schema = Schema(name=table_name, columns=columns_list, description=description)
+    table = Table(retention_in_days=retention_in_days,
+                  total_retention_in_days=total_retention_in_days,
+                  schema=schema,
+                  plan=plan
+                  )
+    return sdk_no_wait(no_wait, client.begin_create_or_update, resource_group_name,
+                       workspace_name, table_name, table)
+
+
+def create_log_analytics_workspace_table_search_job(client, resource_group_name, workspace_name, table_name,
+                                                    search_query, start_search_time, end_search_time,
+                                                    retention_in_days=None, total_retention_in_days=None, limit=None,
+                                                    no_wait=False):
+    search_results = SearchResults(query=search_query, limit=limit, start_search_time=start_search_time,
+                                   end_search_time=end_search_time)
+    table = Table(retention_in_days=retention_in_days,
+                  total_retention_in_days=total_retention_in_days,
+                  search_results=search_results,
+                  )
+    return sdk_no_wait(no_wait, client.begin_create_or_update, resource_group_name,
+                       workspace_name, table_name, table)
+
+
+def update_log_analytics_workspace_table(client, resource_group_name, workspace_name, table_name, columns=[],
+                                         retention_in_days=None, total_retention_in_days=None, plan=None,
+                                         description=None, no_wait=False):
+    columns_list = [] if columns else None
+    for col in columns:
+        if '=' in col:
+            n, t = col.split('=', 1)
+            if t.lower() not in [x.value.lower() for x in ColumnTypeEnum]:
+                raise InvalidArgumentValueError('InvalidArgumentValueError: "{}" is not a valid value for type_name. '
+                                                'Allowed values: string, int, long, real, boolean, dateTime, guid, '
+                                                'dynamic".'.format(t))
+        else:
+            raise ArgumentUsageError('Usage error: --columns should be provided in colunm_name=colunm_type format')
+        columns_list.append(Column(name=n, type=t))
+    schema = None
+    if columns or description is not None:
+        schema = Schema(name=table_name, columns=columns_list, description=description)
+    table = Table(retention_in_days=retention_in_days,
+                  total_retention_in_days=total_retention_in_days,
+                  schema=schema,
+                  plan=plan
+                  )
+    return sdk_no_wait(no_wait, client.begin_update, resource_group_name, workspace_name, table_name, table)