Our organization expects to ingest data from more than 50 sources into Azure Log Analytics, potentially resulting in hundreds of standard and custom tables. What naming convention would keep the tables easy to find, understand, and manage over time? I'm especially interested in guidance on prefixes, source or application identifiers, casing, and any restrictions that should be considered for custom table names.
2 Answers
The best convention depends on how the data is being collected and separated. In some environments, teams use separate Log Analytics workspaces for each application, which reduces the need to encode the application name into every table. If many sources are being collected into one workspace, including a short source or system identifier in the table name becomes more useful. Before creating hundreds of tables, it’s worth deciding whether a new table is genuinely needed or whether related records can share an existing schema with a source field for filtering.
Custom Log Analytics table names can be up to 256 characters, and custom tables need to use the `_CL` suffix. A PascalCase convention can make longer names easier to scan, but the most important thing is to define a predictable structure and apply it consistently. For example, you could combine the source, workload, and data type in a fixed order, such as `SourceApplicationEvent_CL` or `VendorServiceAudit_CL`. Keep names concise and document the convention so new tables don’t introduce slightly different variations.
The goal is to bring many different kinds of data into a shared workspace, so I’m mainly concerned that the tables will become difficult to use without a clear, consistent naming scheme.