Log analytics workspace diagnostics setting not getting integrated with logic app in terraform with pipeline

Question

Log analytics workspace diagnostics setting not getting integrated with logic app in terraform with pipeline

Krishan Nagwan 0

Hi Team,

I have been trying to integrate the diagnostic setting in the logic app with log analytics workspace. especially the logs and All metrics. but not able to integrate with azure pipeline.
Neither getting the error nor getting integrated . it keeps on running.

please suggest some course of action.

I have tried the code from Microsoft azurerm registery itself.

please enlighten me with some solutions.

Regards

Krishan Nagwan

Siva shunmugam Nadessin 1,990 Reputation points Microsoft External Staff Moderator

2025-09-19T08:05:59.01+00:00

Hello Krishan Nagwan,

We see from your question that you mentioned 'have tried the code from Microsoft Azurerm registry itself.' Could you kindly specify which code or document you are referring to, so we can investigate further?

Krishan Nagwan 0

name               = "example" 												 target_resource_id = azurerm_logic_app_standard.example.id
   storage_account_id = azurerm_storage_account.example.id
   log_analytics_workspace_id = azurerm_log_analytics_workspace.datalaw.id
   log_analytics_destination_type = "Dedicated" # "AzureDiagnostics"


  enabled_log {
    category = "AuditEvent"
  }

  enabled_metric {
    category = "AllMetrics"
  }
}

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting

This is the registry link for terraform code .

Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-19T11:43:22.74+00:00
Hi Krishan Nagwan,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Please try below and let us know your findings.

Remove log_analytics_destination_type from your Terraform config. So, TF doesn’t try to force a value the API returns as null. That avoids drift and plan churn.

If you must keep the attribute - below config can be done so that Terraform ignores changing the attribute. So, TF won’t continually try to reconcile it with whatever the API returns:
lifecycle { ignore_changes = [ log_analytics_destination_type ] }

enabled_log - we can either fix the category or remove the block

The enabled_log block is optional. Removing it reduces the surface area for provider/API mismatch and is a quick way to avoid issues while you troubleshoot.

If you need to keep enabled_log, make sure you use a valid category for the resource. For Logic Apps, the correct category is WorkflowRuntime (display name “Workflow runtime diagnostic events”). AuditEvent is not a valid Logic App category and will not produce workflow logs.

We can get the available categories for the exact resource by using below command:

az monitor diagnostic-settings categories list --resource /subscriptions//resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<logicAppName>

Alternative - create the diagnostic setting once with the Azure CLI / REST API, then import it into Terraform state. Terraform will then manage the resource without repeatedly trying to re-create or change that attribute.
terraform import azurerm_monitor_diagnostic_setting.example \ /subscriptions//resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<logicAppName>/providers/microsoft.insights/diagnosticSettings/<setting-name>
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-22T02:47:55.72+00:00

Hi Krishan Nagwan, following up to see if you had a chance to check my previous response and if it was helpful. Please do let me know if you're still facing the issue.
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-23T04:59:44.8333333+00:00

Hi Krishan Nagwan, I hope you checked my last response, and it was helpful. Please do let me know if you need any further assistance on this.
Krishan Nagwan 0 Reputation points

2025-09-23T05:25:01.2+00:00
# Logs # enabled_log { # category = " # } # enabled_metric { # category = "AllMetrics" # }

lifecycle { ignore_changes = [ log_analytics_destination_type ] }
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-23T08:17:14.2233333+00:00
Hi Krishan Nagwan, Thank you for the details. Please share the requested information over Private messages to assist you further on this.

Also, were you able to try below. Please share findings from this step as well.

Alternative - create the diagnostic setting once with the Azure CLI / REST API, then import it into Terraform state. Terraform will then manage the resource without repeatedly trying to re-create or change that attribute.

terraform import azurerm_monitor_diagnostic_setting.example \ /subscriptions//resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<logicAppName>/providers/microsoft.insights/diagnosticSettings/<setting-name>
Krishan Nagwan 0 Reputation points

2025-09-24T05:18:08.7433333+00:00

thanks for the suggestion. You mean adding it manually.
Harish Badijana 320 Reputation points Microsoft External Staff Moderator

2025-09-24T07:36:31.97+00:00

@Krishan nagwan To confirm, Yes. Adding the steps manually. Also please check the private message and share the requested information to assist further
Krishan Nagwan 0 Reputation points

2025-09-26T05:25:45.6233333+00:00

Hi I am available please connect for further analysis.
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-26T05:33:33.5366667+00:00

Hi Krishan Nagwan, I have requested details over private messages. Could you please check and respond there.
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-10-03T09:04:19.15+00:00
Hi Krishan Nagwan, could you please try below and let us know the findings.

check storage account network settings and make it public before creating logic app.

When logic app gets stuck in creating and in portal we can see it gets created. Could you please run below command to see if it is provisioned successfully.

az resource show --ids "/subscriptions//resourceGroups/<rg>/providers/Microsoft.Web/sites/<logicapp-name>" --query "properties.provisioningState" -o tsv
Anurag Rohikar 2,560 Reputation points Microsoft External Staff Moderator

2025-10-08T08:13:25.47+00:00
Hello Krishna, Thanks for sharing the details so far! To help isolate whether the issue lies within the Terraform setup, the Azure pipeline, or the platform itself, could you please confirm the following points?

When you run terraform plan, do you see any warnings or errors related to the diagnostic setting or the Logic App resource?

Have you tried running terraform apply from your local machine or Azure Cloud Shell using the same Terraform configuration? Does it succeed there?

When you run terraform apply in the Azure Pipeline, does it show any error messages or logs before it starts hanging, or does it just keep running indefinitely?

Are you using a release pipeline with a CLI script to deploy the diagnostic setting? If yes, could you confirm whether the script throws any errors or logs in the output window?

Lastly, could you please share whether any diagnostic settings get partially created in the portal before the pipeline hangs?

This will help us pinpoint whether the problem is occurring due to the pipeline execution environment, Terraform itself, or the Azure API.

Thanks for your help while we narrow this down!
Anurag Rohikar 2,560 Reputation points Microsoft External Staff Moderator

2025-10-13T08:42:16.9033333+00:00

Hi Krishan Nagwan, following up to see if you have a chance to check my previous response in private message also on teams and helped, do let me know if you have any further questions on this. Thank you!
Anurag Rohikar 2,560 Reputation points Microsoft External Staff Moderator

2025-10-15T09:45:59.8166667+00:00
Hi Krishan Nagwan,

Thank you for sharing the details. From the logs, it looks like the pipeline is timing out while creating the Logic App resource itself before the diagnostic setting step runs.

Could you please check and share the below details to help isolate the issue:

Is the App Service Plan used (data.azurerm_app_service_plan.existing_asp) a Linux plan?

Logic Apps (Standard) require a Linux-based App Service Plan.

Is the Storage Account (data.azurerm_storage_account.existingstore) set to Public network access?

If it’s restricted by VNet or private endpoint, provisioning may hang indefinitely.

If you manually create the Logic App from the Azure Portal (same RG and plan), does it succeed instantly or also hang?

Could you share your Terraform apply output with TF_LOG=DEBUG enabled?

Once we confirm these, we can pinpoint whether this is a network or configuration-level timeout.

1 answer

Your answer

Siva shunmugam Nadessin 1,990 Reputation points Microsoft External Staff Moderator

2025-09-19T08:05:59.01+00:00

Hello Krishan Nagwan,

We see from your question that you mentioned 'have tried the code from Microsoft Azurerm registry itself.' Could you kindly specify which code or document you are referring to, so we can investigate further?
Krishan Nagwan 0 Reputation points

2025-09-19T08:38:51.14+00:00

name = "example" target_resource_id = azurerm_logic_app_standard.example.id storage_account_id = azurerm_storage_account.example.id log_analytics_workspace_id = azurerm_log_analytics_workspace.datalaw.id log_analytics_destination_type = "Dedicated" # "AzureDiagnostics" enabled_log { category = "AuditEvent" } enabled_metric { category = "AllMetrics" } }

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting

This is the registry link for terraform code .
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-19T11:43:22.74+00:00

Hi Krishan Nagwan,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Please try below and let us know your findings.

Remove log_analytics_destination_type from your Terraform config. So, TF doesn’t try to force a value the API returns as null. That avoids drift and plan churn.

If you must keep the attribute - below config can be done so that Terraform ignores changing the attribute. So, TF won’t continually try to reconcile it with whatever the API returns:
lifecycle { ignore_changes = [ log_analytics_destination_type ] }

enabled_log - we can either fix the category or remove the block

The enabled_log block is optional. Removing it reduces the surface area for provider/API mismatch and is a quick way to avoid issues while you troubleshoot.

If you need to keep enabled_log, make sure you use a valid category for the resource. For Logic Apps, the correct category is WorkflowRuntime (display name “Workflow runtime diagnostic events”). AuditEvent is not a valid Logic App category and will not produce workflow logs.

We can get the available categories for the exact resource by using below command:

az monitor diagnostic-settings categories list --resource /subscriptions//resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<logicAppName>

Alternative - create the diagnostic setting once with the Azure CLI / REST API, then import it into Terraform state. Terraform will then manage the resource without repeatedly trying to re-create or change that attribute.
terraform import azurerm_monitor_diagnostic_setting.example \ /subscriptions//resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<logicAppName>/providers/microsoft.insights/diagnosticSettings/<setting-name>
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-22T02:47:55.72+00:00

Hi Krishan Nagwan, following up to see if you had a chance to check my previous response and if it was helpful. Please do let me know if you're still facing the issue.
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-23T04:59:44.8333333+00:00

Hi Krishan Nagwan, I hope you checked my last response, and it was helpful. Please do let me know if you need any further assistance on this.
Krishan Nagwan 0 Reputation points

2025-09-23T05:25:01.2+00:00

# Logs # enabled_log { # category = " # } # enabled_metric { # category = "AllMetrics" # }

lifecycle { ignore_changes = [ log_analytics_destination_type ] }
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-23T08:17:14.2233333+00:00

Hi Krishan Nagwan, Thank you for the details. Please share the requested information over Private messages to assist you further on this.

Also, were you able to try below. Please share findings from this step as well.

Alternative - create the diagnostic setting once with the Azure CLI / REST API, then import it into Terraform state. Terraform will then manage the resource without repeatedly trying to re-create or change that attribute.

terraform import azurerm_monitor_diagnostic_setting.example \ /subscriptions//resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<logicAppName>/providers/microsoft.insights/diagnosticSettings/<setting-name>
Krishan Nagwan 0 Reputation points

2025-09-24T05:18:08.7433333+00:00

thanks for the suggestion. You mean adding it manually.
Harish Badijana 320 Reputation points Microsoft External Staff Moderator

2025-09-24T07:36:31.97+00:00

@Krishan nagwan To confirm, Yes. Adding the steps manually. Also please check the private message and share the requested information to assist further
Krishan Nagwan 0 Reputation points

2025-09-26T05:25:45.6233333+00:00

Hi I am available please connect for further analysis.
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-09-26T05:33:33.5366667+00:00

Hi Krishan Nagwan, I have requested details over private messages. Could you please check and respond there.
Rakesh Mishra 2,025 Reputation points Microsoft External Staff Moderator

2025-10-03T09:04:19.15+00:00

Hi Krishan Nagwan, could you please try below and let us know the findings.

check storage account network settings and make it public before creating logic app.

When logic app gets stuck in creating and in portal we can see it gets created. Could you please run below command to see if it is provisioned successfully.

az resource show --ids "/subscriptions//resourceGroups/<rg>/providers/Microsoft.Web/sites/<logicapp-name>" --query "properties.provisioningState" -o tsv
Anurag Rohikar 2,560 Reputation points Microsoft External Staff Moderator

2025-10-08T08:13:25.47+00:00

Hello Krishna, Thanks for sharing the details so far! To help isolate whether the issue lies within the Terraform setup, the Azure pipeline, or the platform itself, could you please confirm the following points?

When you run terraform plan, do you see any warnings or errors related to the diagnostic setting or the Logic App resource?

Have you tried running terraform apply from your local machine or Azure Cloud Shell using the same Terraform configuration? Does it succeed there?

When you run terraform apply in the Azure Pipeline, does it show any error messages or logs before it starts hanging, or does it just keep running indefinitely?

Are you using a release pipeline with a CLI script to deploy the diagnostic setting? If yes, could you confirm whether the script throws any errors or logs in the output window?

Lastly, could you please share whether any diagnostic settings get partially created in the portal before the pipeline hangs?

This will help us pinpoint whether the problem is occurring due to the pipeline execution environment, Terraform itself, or the Azure API.

Thanks for your help while we narrow this down!
Anurag Rohikar 2,560 Reputation points Microsoft External Staff Moderator

2025-10-13T08:42:16.9033333+00:00

Hi Krishan Nagwan, following up to see if you have a chance to check my previous response in private message also on teams and helped, do let me know if you have any further questions on this. Thank you!
Anurag Rohikar 2,560 Reputation points Microsoft External Staff Moderator

2025-10-15T09:45:59.8166667+00:00

Hi Krishan Nagwan,

Thank you for sharing the details. From the logs, it looks like the pipeline is timing out while creating the Logic App resource itself before the diagnostic setting step runs.

Could you please check and share the below details to help isolate the issue:

Is the App Service Plan used (data.azurerm_app_service_plan.existing_asp) a Linux plan?

Logic Apps (Standard) require a Linux-based App Service Plan.

Is the Storage Account (data.azurerm_storage_account.existingstore) set to Public network access?

If it’s restricted by VNet or private endpoint, provisioning may hang indefinitely.

If you manually create the Logic App from the Azure Portal (same RG and plan), does it succeed instantly or also hang?

Could you share your Terraform apply output with TF_LOG=DEBUG enabled?

Once we confirm these, we can pinpoint whether this is a network or configuration-level timeout.

Answer 1

Krishan Nagwan 0

We tried that method also, still the problem is same.

   # Logs
#   enabled_log {
#     category = "
#      }

#   enabled_metric {
#     category = "AllMetrics"
#   }

lifecycle {
ignore_changes = [ log_analytics_destination_type ]
}

Share via

Log analytics workspace diagnostics setting not getting integrated with logic app in terraform with pipeline

1 answer

Your answer