From b15fb7f4f3be90fc51d78c05cc2aa5376cd18bc0 Mon Sep 17 00:00:00 2001
From: Bryn Thomas <bryn.thomas@planninginspectorate.gov.uk>
Date: Mon, 16 Mar 2026 18:41:21 +0000
Subject: [PATCH 1/2] feat(appeals): test stream transformation

---
 .../uk-west/appeals-service/monitoring.tf     | 142 ++++++++++++++++++
 1 file changed, 142 insertions(+)

diff --git a/app/stacks/uk-west/appeals-service/monitoring.tf b/app/stacks/uk-west/appeals-service/monitoring.tf
index f96d6da13..50a0a890d 100644
--- a/app/stacks/uk-west/appeals-service/monitoring.tf
+++ b/app/stacks/uk-west/appeals-service/monitoring.tf
@@ -188,3 +188,145 @@ resource "azurerm_monitor_scheduled_query_rules_alert_v2" "log_cap" {
     ]
   }
 }
+
+# transformations
+resource "azurerm_monitor_data_collection_rule" "appeals_service_dcr" {
+  name                = "${local.service_name}-${local.resource_suffix}-dcr"
+  resource_group_name = azurerm_resource_group.appeals_service_stack.name
+  location            = azurerm_resource_group.appeals_service_stack.location
+
+  data_flow {
+    streams      = ["Microsoft-InsightsAppDependencies"]
+    destinations = ["log_analytics"]
+
+    transform_kql = <<KQL
+      source
+      | project
+          TimeGenerated,
+          Target,
+          DependencyType,
+          Name,
+          Data,
+          Success,
+          ResultCode,
+          DurationMs,
+          PerformanceBucket,
+          ParentId,
+          AppRoleName
+      KQL
+  }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppExceptions"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project
+  #         TimeGenerated,
+  #         ProblemId,
+  #         ExceptionType,
+  #         Method,
+  #         OuterType,
+  #         OuterMessage,
+  #         OuterMethod,
+  #         InnermostType,
+  #         InnermostMessage,
+  #         SeverityLevel
+  #   KQL
+  # }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppMetrics"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project TimeGenerated, Name, ItemCount, Sum, Min, Max, AppRoleName
+  #   KQL
+  # }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppPerformanceCounters"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project TenantId, TimeGenerated, Name, Category, Counter, Value, AppRoleName
+  #   KQL
+  # }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppRequests"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project
+  #         Id,
+  #         TimeGenerated,
+  #         AppRoleName,
+  #         Name,
+  #         Url,
+  #         Success,
+  #         ResultCode,
+  #         DurationMs,
+  #         PerformanceBucket
+  #   KQL
+  # }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppServiceConsoleLogs"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | extend parsed = parse_json(ResultDescription)
+  #     | extend
+  #         Level = case(
+  #             isnull(parsed.level), Level,
+  #             parsed.level == 20, "Debug",
+  #             parsed.level == 30, "Informational",
+  #             parsed.level == 40, "Warning",
+  #             parsed.level == 50, "Error",
+  #             tostring(parsed.level)
+  #         )
+  #     | project TimeGenerated, Level, ResultDescription
+  #   KQL
+  # }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppTraces"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project TimeGenerated, AppRoleName, Message, OperationName, SeverityLevel
+  #   KQL
+  # }
+
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsFunctionAppLogs"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project
+  #         TimeGenerated,
+  #         Category,
+  #         Message,
+  #         ExceptionDetails,
+  #         ExceptionMessage,
+  #         ExceptionType,
+  #         FunctionName,
+  #         EventName
+  #   KQL
+  # }
+
+  destinations {
+    log_analytics {
+      workspace_resource_id = azurerm_log_analytics_workspace.appeals_service.id
+      name                  = "log_analytics"
+    }
+  }
+}

From a0f81582ee3dd767151af993bfd893c2116bc983 Mon Sep 17 00:00:00 2001
From: Bryn Thomas <bryn.thomas@planninginspectorate.gov.uk>
Date: Mon, 16 Mar 2026 18:53:05 +0000
Subject: [PATCH 2/2] feat(appeals): test workspace  transformation

---
 .../uk-west/appeals-service/monitoring.tf     | 29 ++++++++++++++++---
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/app/stacks/uk-west/appeals-service/monitoring.tf b/app/stacks/uk-west/appeals-service/monitoring.tf
index 50a0a890d..df80d7c54 100644
--- a/app/stacks/uk-west/appeals-service/monitoring.tf
+++ b/app/stacks/uk-west/appeals-service/monitoring.tf
@@ -194,11 +194,11 @@ resource "azurerm_monitor_data_collection_rule" "appeals_service_dcr" {
   name                = "${local.service_name}-${local.resource_suffix}-dcr"
   resource_group_name = azurerm_resource_group.appeals_service_stack.name
   location            = azurerm_resource_group.appeals_service_stack.location
+  kind                = "WorkspaceTransforms"
 
   data_flow {
-    streams      = ["Microsoft-InsightsAppDependencies"]
-    destinations = ["log_analytics"]
-
+    streams       = ["Microsoft-Table-AppDependencies"]
+    destinations  = ["log_analytics"]
     transform_kql = <<KQL
       source
       | project
@@ -213,9 +213,30 @@ resource "azurerm_monitor_data_collection_rule" "appeals_service_dcr" {
           PerformanceBucket,
           ParentId,
           AppRoleName
-      KQL
+    KQL
   }
 
+  # data_flow {
+  #   streams      = ["Microsoft-InsightsAppDependencies"]
+  #   destinations = ["log_analytics"]
+
+  #   transform_kql = <<KQL
+  #     source
+  #     | project
+  #         TimeGenerated,
+  #         Target,
+  #         DependencyType,
+  #         Name,
+  #         Data,
+  #         Success,
+  #         ResultCode,
+  #         DurationMs,
+  #         PerformanceBucket,
+  #         ParentId,
+  #         AppRoleName
+  #     KQL
+  # }
+
   # data_flow {
   #   streams      = ["Microsoft-InsightsAppExceptions"]
   #   destinations = ["log_analytics"]