how to properly parse data in custom logs for log analytcis(i have no response from query actually) ?

Hello Erwan,

Your file format is valid for Custom Text Logs via AMA, but Azure Monitor won’t automatically split Time=... Data1=... Data2=... into separate fields. For custom text logs, each log entry is typically ingested as a single string in the RawData column unless you parse it in a query or with a DCR transformation. Also, the file must be ASCII or UTF-8 (not UTF-16), and each new record should be appended on a new line.

start by querying it like this:

CustomTable_CL

| parse RawData with "Time=" EventTime " Data1=" Data1 " Data2=" Data2

| extend EventTime = todatetime(EventTime)

| project TimeGenerated, EventTime, Data1, Data2, RawData

Make sure the file is really saved as UTF-8 or ASCII. Azure Monitor text collection does not support UTF-16.

Make sure each event is on one line. For custom text logs, if Azure Monitor doesn’t detect a supported timestamp format for record splitting, it falls back to end-of-line as the delimiter.

Make sure new data is appended to the file, not overwritten.

If you want the fields to be stored as separate columns permanently, use a DCR transformation. Transformation output must match the destination table schema and must include TimeGenerated.