Skip to main content
Send Policy Gateway events to an Azure Log Analytics workspace via the Data Collector API.

​
Configure

FieldValue
TypeAzure Monitor
Workspace IDFrom Azure Portal → Log Analytics workspace → Agents
Shared KeyPrimary or secondary key from the same Agents page
Log TypeCustom log table name. Default PolicyGatewayAudit
Endpoint is derived as https://<workspace_id>.ods.opinsights.azure.com/api/logs.

​
Event shape

Events arrive as rows in the custom log table (suffixed _CL by Log Analytics): 
{
  "TimeGenerated": "2026-04-20T18:30:00Z",
  "event_id_s": "3d14a2b8-...",
  "event_type_s": "enforcement",
  "policy_id_s": "support-bot",
  "decision_s": "refuse",
  "effective_decision_s": "allow",
  "enforced_b": false,
  "rollout_mode_s": "shadow",
  "reason_code_s": "REFUSE",
  "policy_target_s": "chat.completions",
  "project_id_s": "proj_support_bot",
  "model_s": "abliterated-model"
}
(Log Analytics auto-appends type suffixes — _s for strings, _b for booleans, _d for numbers, _t for datetimes.)

​
Query

PolicyGatewayAudit_CL
| where decision_s == "refuse" and enforced_b == true
| summarize count() by reason_code_s, bin(TimeGenerated, 1h)
See the full field list in connectors.