Hello mrcode,
The reason you cannot switch an existing table from Basic to Auxiliary in Azure Log Analytics is due to design and architectural constraints of the Auxiliary plan. Here’s the detailed reasoning:
1. Auxiliary Plan Is Only Supported at Table Creation
- The Auxiliary plan is intended for low-cost ingestion and retention of verbose or compliance logs.
- It is only available for new custom tables created via the API and cannot be applied to built-in Azure tables or existing tables.
- Once a table is created with Auxiliary, its plan is immutable. This is explicitly documented: “Setting up a table with the Auxiliary plan is only supported on new tables. After you create a table with an Auxiliary plan, you can't switch the table's plan.”
2. Schema and Query Model Differences
· Auxiliary tables have different schema constraints (e.g., no dynamic columns) and optimized storage format for cost efficiency.
· They use Delta Parquet-based storage for batch processing, which is fundamentally different from the indexed storage used by Analytics/Basic tables.
· Switching plans would require rebuilding the table and re-ingesting data, which could break queries, alerts, and compliance guarantees.
3. Performance and Feature Trade-offs
- Auxiliary tables are designed for cheap storage and slower queries, not for real-time analytics.
- If Microsoft allowed switching, existing data would need to be transformed to match Auxiliary’s limitations (e.g., reduced query performance, limited KQL operators), which could lead to data integrity and feature compatibility issues.
4. Cost and Compliance Considerations
- Auxiliary plan targets high-volume, low-touch logs for compliance and auditing.
- Allowing conversion could create billing inconsistencies and compliance risks, as retention and query capabilities differ significantly between plans.
Current Options
- You can switch between Analytics and Basic plans for supported tables once per week.
- For Auxiliary, you must create a new custom table and redirect ingestion via Data Collection Rules (DCR) or the Logs ingestion API.
Roadmap
- As of now, Microsoft has not announced support for converting existing tables to Auxiliary. This limitation is by design and documented in official guidance.