{"id":1148,"date":"2021-12-14T23:08:26","date_gmt":"2021-12-14T10:08:26","guid":{"rendered":"https:\/\/blog.wiseowls.co.nz\/?p=1148"},"modified":"2026-03-08T00:48:06","modified_gmt":"2026-03-07T11:48:06","slug":"ingesting-powershell-generated-files-into-azure-log-analytics-watch-out","status":"publish","type":"post","link":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/","title":{"rendered":"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out!"},"content":{"rendered":"<p>Windows PowerShell is an extremely useful tool when it comes to quickly churning out useful bits of automation. If these scripts run unattended, we&#8217;d often sprinkle logs to aid troubleshooting. What one does with these logs totally depends on application, but we&#8217;ve seen some decent Sentinel deployments with alerting and hunting queries (which is beside the point of today&#8217;s post).<\/p>\n<p>We recently had a mysterious issue where we tried ingesting a log file into Azure Log Analytics Workspace but it never came through&#8230;<\/p>\n<h2 class=\"wp-block-heading\">Ingesting custom logs <\/h2>\n<p>Generally speaking, this is a <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/agents\/data-sources-custom-logs\">very simple operation<\/a>. Spin up log analytics workspace and add a &#8220;Custom Logs&#8221; entry:<\/p>\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1226\" height=\"730\" src=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/create-custom-log.gif\" alt=\"Creating a custom log entry in Azure Log Analytics workspace\" class=\"wp-image-1152\"\/><\/figure>\n<p>Finally, make sure to install Monitoring Agent on target machine and that&#8217;s it:<\/p>\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"781\" height=\"566\" src=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-2.png\" alt=\"Log Analytics custom log configuration showing file path settings\" class=\"wp-image-1154\" srcset=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-2.png 781w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-2-300x217.png 300w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-2-768x557.png 768w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 984px) 61vw, (max-width: 1362px) 45vw, 600px\" \/><\/figure>\n<p>After a little while, new log entries would get beamed up to Azure:<\/p>\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"865\" height=\"733\" src=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-3.png\" alt=\"PowerShell-generated log file with BOM encoding visible in hex editor\" class=\"wp-image-1155\" srcset=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-3.png 865w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-3-300x254.png 300w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-3-768x651.png 768w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/figure>\n<p>Here we let our scripts run and went ahead to grab some drinks. But after a couple of hours and few bottles of fermented grape juice we realised that nothing happened&#8230;<\/p>\n<h2 class=\"wp-block-heading\">What could possibly go wrong?<\/h2>\n<p>Having double- and triple- checked our setup everything looked solid. For the sake of completeness, our PowerShell script was doing something along the following lines:<\/p>\n<pre class=\"wp-block-code\"><code lang=\"powershell\" class=\"language-powershell\">$scriptDir = \".\"\n$LogFilePath = Join-Path $scriptDir \"log.txt\"\n\n# we do not overwrite the file. we always append\nif (!(Test-Path $LogFilePath))\n{\n    $LogFile = New-Item -Path $LogFilePath -ItemType File\n} else {\n    $LogFile = Get-Item -Path $LogFilePath\n}\n\n \"$(Get-Date -Format \"yyyy-MM-dd HH:mm:ss\") Starting Processing\" | Out-File $LogFile -Append\n\n# do work\n\n\"$(Get-Date -Format \"yyyy-MM-dd HH:mm:ss\") Ending Processing\" | Out-File $LogFile -Append\n<\/code><\/pre>\n<p>Nothing fancy, just making sure timestamps are in a supported format. We also made sure we do not rotate the file as log collection agent will not pick it up. So, we turned to <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/agents\/data-sources-custom-logs\">the documentation<\/a>:<\/p>\n<ul class=\"wp-block-list\">\n<li>The log must either have a single entry per line or use a timestamp matching one of the following formats at the start of each entry &#8211; <strong>\u2713 check <\/strong><\/li>\n<li>The log file must not allow circular logging or log rotation, where the file is overwritten with new entries &#8211; <strong>\u2713 check <\/strong><\/li>\n<li>For Linux, time zone conversion is not supported for time stamps in the logs &#8211; <strong>not our case<\/strong><\/li>\n<li>and finally, the log file must use ASCII or UTF-8 encoding. Other formats such as UTF-16 are not supported <strong>&#8211; let&#8217;s look at that a bit closer<\/strong><\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">Figuring this out<\/h2>\n<p>Looking at <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.utility\/out-file\">Out-File<\/a>, we see that default <code>Encoding<\/code> is utf8NoBOM. This is exactly what we&#8217;re after, but examining our file revealed a troubling discrepancy: <\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"80\" src=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-5-1024x80.png\" alt=\"Log Analytics query showing successfully ingested entries after BOM fix\" class=\"wp-image-1157\" srcset=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-5-1024x80.png 1024w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-5-300x23.png 300w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-5-768x60.png 768w, https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/12\/image-5.png 1193w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/figure>\n<p>That would explain why Monitoring Agent would not ingest our custom logs. Fixing this is rather easy, just set default output encoding at the start of the script: <code>$PSDefaultParameterValues['Out-File:Encoding'] = 'utf8'<\/code>. <\/p>\n<p>But the question of how that could happen still remained&#8230;<\/p>\n<h2 class=\"wp-block-heading\">Check your version<\/h2>\n<p>After a few more hours trying various combinations of inputs and PowerShell parameters, we checked <code>$PSVersionTable.PSVersion<\/code> and realised we ran PS5.1. This is where it started to click: documentation by default pointed us to the <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.utility\/out-file?view=powershell-7.2\">latest 7.2 LTS<\/a> where the default encoding is different! Indeed, <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.utility\/out-file?view=powershell-5.1#parameters\">rewinding to PS5.1<\/a> reveals that the default used to be <code>unicode<\/code>: UTF-16 with the little-endian byte order.<\/p>\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n<p>Since PowerShell 7.x+ is not exclusive to Windows anymore, Microsoft seems to have accepted a few changes dependent on underlying behaviours of .NET frameworks these were built upon. There&#8217;s in fact an extensive list of <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/scripting\/whats-new\/differences-from-windows-powershell?view=powershell-7.2\">breaking changes<\/a> that mention encoding a few times. We totally support the need to advance tooling and converging tech. We, however, hope that as Monitoring Agent matures, more of these restrictions will get removed and this will not be an issue anymore. Until then &#8211; happy cloud computing! <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows PowerShell is an extremely useful tool when it comes to quickly churning out useful bits of automation. If these scripts run unattended, we&#8217;d often sprinkle logs to aid troubleshooting. What one does with these logs totally depends on application, but we&#8217;ve seen some decent Sentinel deployments with alerting and hunting queries (which is beside &hellip; <a href=\"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Ingesting PowerShell-generated files into Azure Log Analytics? Watch out!&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":925,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[50],"tags":[48,55],"class_list":["post-1148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","tag-azure","tag-powershell"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ingesting PowerShell-generated files into Azure Log Analytics? Watch out! - Timur and associates<\/title>\n<meta name=\"description\" content=\"Today we&#039;ll take a look at why Azure Custom Logs may silently fail when ingesting files produced by Windows Powershell\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out! - Timur and associates\" \/>\n<meta property=\"og:description\" content=\"Today we&#039;ll take a look at why Azure Custom Logs may silently fail when ingesting files produced by Windows Powershell\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/\" \/>\n<meta property=\"og:site_name\" content=\"Timur and associates\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-14T10:08:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-07T11:48:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/09\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1247\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"timur\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@TimurKh\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/\"},\"author\":{\"name\":\"timur\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/#\\\/schema\\\/person\\\/34d0ed30d573b5bc317ea990bd2e0c59\"},\"headline\":\"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out!\",\"datePublished\":\"2021-12-14T10:08:26+00:00\",\"dateModified\":\"2026-03-07T11:48:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/\"},\"wordCount\":544,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg\",\"keywords\":[\"azure\",\"powershell\"],\"articleSection\":[\"Cloud\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/\",\"url\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/\",\"name\":\"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out! - Timur and associates\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg\",\"datePublished\":\"2021-12-14T10:08:26+00:00\",\"dateModified\":\"2026-03-07T11:48:06+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/#\\\/schema\\\/person\\\/34d0ed30d573b5bc317ea990bd2e0c59\"},\"description\":\"Today we'll take a look at why Azure Custom Logs may silently fail when ingesting files produced by Windows Powershell\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#primaryimage\",\"url\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg\",\"width\":2560,\"height\":1247,\"caption\":\"conspiracy\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/index.php\\\/2021\\\/12\\\/14\\\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/#website\",\"url\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/\",\"name\":\"Timur and associates\",\"description\":\"Notes of an IT contractor\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/blog.wiseowls.co.nz\\\/#\\\/schema\\\/person\\\/34d0ed30d573b5bc317ea990bd2e0c59\",\"name\":\"timur\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/23d55e17d4f0990ee4d12bc6e5dcfb58a292934efd62a185756876379e780b16?s=96&r=pg\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/23d55e17d4f0990ee4d12bc6e5dcfb58a292934efd62a185756876379e780b16?s=96&r=pg\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/23d55e17d4f0990ee4d12bc6e5dcfb58a292934efd62a185756876379e780b16?s=96&r=pg\",\"caption\":\"timur\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/TimurKh\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out! - Timur and associates","description":"Today we'll take a look at why Azure Custom Logs may silently fail when ingesting files produced by Windows Powershell","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/","og_locale":"en_US","og_type":"article","og_title":"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out! - Timur and associates","og_description":"Today we'll take a look at why Azure Custom Logs may silently fail when ingesting files produced by Windows Powershell","og_url":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/","og_site_name":"Timur and associates","article_published_time":"2021-12-14T10:08:26+00:00","article_modified_time":"2026-03-07T11:48:06+00:00","og_image":[{"width":2560,"height":1247,"url":"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/09\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg","type":"image\/jpeg"}],"author":"timur","twitter_card":"summary_large_image","twitter_creator":"@TimurKh","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#article","isPartOf":{"@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/"},"author":{"name":"timur","@id":"https:\/\/blog.wiseowls.co.nz\/#\/schema\/person\/34d0ed30d573b5bc317ea990bd2e0c59"},"headline":"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out!","datePublished":"2021-12-14T10:08:26+00:00","dateModified":"2026-03-07T11:48:06+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/"},"wordCount":544,"commentCount":0,"image":{"@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/09\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg","keywords":["azure","powershell"],"articleSection":["Cloud"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/","url":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/","name":"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out! - Timur and associates","isPartOf":{"@id":"https:\/\/blog.wiseowls.co.nz\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#primaryimage"},"image":{"@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/09\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg","datePublished":"2021-12-14T10:08:26+00:00","dateModified":"2026-03-07T11:48:06+00:00","author":{"@id":"https:\/\/blog.wiseowls.co.nz\/#\/schema\/person\/34d0ed30d573b5bc317ea990bd2e0c59"},"description":"Today we'll take a look at why Azure Custom Logs may silently fail when ingesting files produced by Windows Powershell","breadcrumb":{"@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#primaryimage","url":"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/09\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg","contentUrl":"https:\/\/blog.wiseowls.co.nz\/wp-content\/uploads\/2021\/09\/tom-radetzki-idRpmZVNs30-unsplash-scaled.jpg","width":2560,"height":1247,"caption":"conspiracy"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.wiseowls.co.nz\/index.php\/2021\/12\/14\/ingesting-powershell-generated-files-into-azure-log-analytics-watch-out\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.wiseowls.co.nz\/"},{"@type":"ListItem","position":2,"name":"Ingesting PowerShell-generated files into Azure Log Analytics? Watch out!"}]},{"@type":"WebSite","@id":"https:\/\/blog.wiseowls.co.nz\/#website","url":"https:\/\/blog.wiseowls.co.nz\/","name":"Timur and associates","description":"Notes of an IT contractor","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.wiseowls.co.nz\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.wiseowls.co.nz\/#\/schema\/person\/34d0ed30d573b5bc317ea990bd2e0c59","name":"timur","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/23d55e17d4f0990ee4d12bc6e5dcfb58a292934efd62a185756876379e780b16?s=96&r=pg","url":"https:\/\/secure.gravatar.com\/avatar\/23d55e17d4f0990ee4d12bc6e5dcfb58a292934efd62a185756876379e780b16?s=96&r=pg","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/23d55e17d4f0990ee4d12bc6e5dcfb58a292934efd62a185756876379e780b16?s=96&r=pg","caption":"timur"},"sameAs":["https:\/\/x.com\/TimurKh"]}]}},"_links":{"self":[{"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/posts\/1148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/comments?post=1148"}],"version-history":[{"count":8,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/posts\/1148\/revisions"}],"predecessor-version":[{"id":1351,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/posts\/1148\/revisions\/1351"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/media\/925"}],"wp:attachment":[{"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/media?parent=1148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/categories?post=1148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wiseowls.co.nz\/index.php\/wp-json\/wp\/v2\/tags?post=1148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}