> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abliteration.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Monitor

> Send Policy Gateway events to an Azure Log Analytics workspace via the Data Collector API.

Send Policy Gateway events to an Azure Log Analytics workspace via the Data Collector API.

## Configure

| Field        | Value                                                |
| ------------ | ---------------------------------------------------- |
| Type         | Azure Monitor                                        |
| Workspace ID | From Azure Portal → Log Analytics workspace → Agents |
| Shared Key   | Primary or secondary key from the same Agents page   |
| Log Type     | Custom log table name. Default `PolicyGatewayAudit`  |

Endpoint is derived as `https://<workspace_id>.ods.opinsights.azure.com/api/logs`.

## Event shape

Events arrive as rows in the custom log table (suffixed `_CL` by Log Analytics):

```json theme={"system"}
{
  "TimeGenerated": "2026-04-20T18:30:00Z",
  "event_id_s": "3d14a2b8-...",
  "event_type_s": "enforcement",
  "policy_id_s": "support-bot",
  "decision_s": "refuse",
  "effective_decision_s": "allow",
  "enforced_b": false,
  "rollout_mode_s": "shadow",
  "reason_code_s": "REFUSE",
  "policy_target_s": "chat.completions",
  "project_id_s": "proj_support_bot",
  "model_s": "abliterated-model"
}
```

(Log Analytics auto-appends type suffixes — `_s` for strings, `_b` for booleans, `_d` for numbers, `_t` for datetimes.)

## Query

```kusto theme={"system"}
PolicyGatewayAudit_CL
| where decision_s == "refuse" and enforced_b == true
| summarize count() by reason_code_s, bin(TimeGenerated, 1h)
```

See the full field list in [connectors](/policy-gateway/connectors).