Format of logs archived to storage through Azure Monitor to change
If you are archiving diagnostic logs or activity logs to a storage account through Azure Monitor be aware that on Nov 1, 2018 there will be a breaking change in the format.
The current format of the PT1H.json file in the storage account uses a JSON array or records. This looks something like:
{
"records": [
{
"time": "2016-01-05T01:32:01.2691226Z"
},
{
"time": "2016-01-05T01:33:56.5264523Z"
}
]
}
The blob format will be change to JSON lines. This means each record will be delimited by a newline, with no outer records array and no commas between JSON records:
{"time": "2016-01-05T01:32:01.2691226Z"}
{"time": "2016-01-05T01:33:56.5264523Z"}