Applies to any data, including data that's already been collected.When you parse data at query time, you include logic in your query to parse data into multiple fields. Increases latency time for collecting data.Fewer parsing options than available in queries.If you change the parsing logic, it will only apply to new data.Can't include data that's already been collected. Better query performance since the query doesn't need to perform parsing.Дisadvantages to this method include the following:.Easier to query the collected data since you don't need to include parse commands in the query.Queries don't have to include any parsing logic and simply use these properties as any other field in the table.ДЄdvantages to this method include the following:

When you parse data at collection time, you configure Custom Fields that create new properties in the table. Each strategy has unique advantages as described below. You can parse data either at ingestion time when the data is collected or at query time when analyzing the data with a query. This article describes different options for parsing log data in Azure Monitor when the data is ingested and when it's retrieved in a query, comparing the relative advantages for each.

By creating separate properties for the different values, you can search and aggregate on each. A common example is a custom log that collects an entire log entry with multiple values into a single property. Parsing this data into multiple properties make it easier to use in queries. Some log data collected by Azure Monitor will include multiple pieces of information in a single property.

Azure email parser