> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mezmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mezmo Log Analysis

> A deprecated source that forwards logs from your Log Analysis account into a Pipeline, including the metadata query fields it attaches to each event.

<Warning>
  This source is deprecated and will be removed in a future release (TBD). You can use the [Mezmo Log Analysis Ingestion](/telemetry-pipelines/log-analysis-ingestion-source)  source as an alternative long-term supported source.

  **NOTE:** as of Jan 30, 2025, this source is only available to customer organizations that had previously utilized it on a pipeline.
</Warning>

## Description

This source will allow your Log Analysis account to automatically forward received logs to this Pipeline.

There is no configuration for this source, it will simply send a copy of your log lines from your log analysis account to this pipeline without further configuration.

<Note>
  Your Log Analysis account can only be used as a single source to a single Pipeline within your account.
</Note>

<Note>
  Log lines that are preserved for Live Tail and Alerting will be included, but fully excluded lines aren't.
</Note>

### Included metadata

By default, the Mezmo Log Analysis Source sends these fields in the metadata query object (e.g. `metadata.query.account` ):

| Field             | Type    | Description                                                                                                                                        |
| ----------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `account`         | String  | The Log Analysis account id the log came from                                                                                                      |
| `app`             | String  | Application that sent the data                                                                                                                     |
| `host`            | String  | Hostname that sent the data                                                                                                                        |
| `id`              | String  | Unique line identifier                                                                                                                             |
| `ingester`        | String  | Ingestion source of the line                                                                                                                       |
| `ip`              | String  | Originating IP where the data was ingested from                                                                                                    |
| `logtype`         | String  | The detected log type according to our [supported log sources](/docs/log-parsing#parsed-log-sources)                                               |
| `mac`             | String  | MAC address of the originating event packet                                                                                                        |
| `mezmo_line_size` | Number  | Number of bytes calculated in the line during processing                                                                                           |
| `noindex`         | Boolean | Shows true if an [exclusion rule](/docs/excluding-log-lines) prevented the line from being indexed (see note above about fully excluded log lines) |
| `nostream`        | Boolean | Shows true if a streaming exclusion rule prevented the line from being forwarded                                                                   |
| `retention`       | Number  | Retention time in days set for the log line if it matches a [variable retention](/docs/variable-retention) rule                                    |
| `tags`            | Array   | Tags added to the request query parameters that contained the event                                                                                |

### Examples

#### Ingested log from a Linux OS

```json theme={null}
{
  "message": {
    "_file": "/var/log/syslog",
    "_ipremote": "10.10.129.13",
    "_line": "Oct 20 19:34:48 ubuntu-s-1vcpu-1gb-intel-nyc1-01 systemd[1]: run-docker-runtime\\x2drunc-moby-8cba3a6e51cd96204c067eb66db06d6eac8b77fefad75a7dd60f4c028fd5072d-runc.tMXKDH.mount: Succeeded.",
    "_ts": 1697830488462,
    "logsource": "ubuntu-nyc1-01",
    "message": "run-docker-runtime\\x2drunc-moby-8cba3a6e51cd96204c067eb66db06d6eac8b77fefad75a7dd60f4c028fd5072d-runc.tMXKDH.mount: Succeeded.",
    "pid": 1,
    "program": "systemd"
  },
  "metadata": {
    "query": {
      "account": "8705fc1d41",
      "app": "syslog",
      "host": "ubuntu-nyc1-01",
      "id": "1668622013281333248",
      "ingester": "logdna-agent/2.2.1 (Ubuntu/20.04)",
      "ip": "10.10.0.5",
      "logtype": "syslogline",
      "mac": "7e:2c:e7:c9:7d:c8",
      "mezmo_line_size": 392
    }
  }
}

```