Separate text-log record boundaries from the timestamp stored in Log Analytics

Source facts

Azure Monitor’s Custom Text Logs source uses a configured timestamp format to recognize record starts. If it cannot find that format, it falls back to line endings. With a matching date at the start of each multiline entry, continuation lines are joined into RawData. ISO 8601 timestamps with fractional seconds are not supported as this delimiter format. Microsoft Learn.

Separately, the destination’s TimeGenerated value defaults to the time the record enters Log Analytics. A transformation can replace that value with a timestamp parsed from the log entry. Recognizing a record boundary is therefore not sufficient evidence of event-time mapping. Microsoft Learn.

Applicability

Review Azure Monitor Agent Custom Text Logs collected into Log Analytics custom tables. Confirm the actual file’s format and supported encoding before applying this behavior. This brief is about entry boundaries and time meaning, not a general DCR deployment procedure.

DSE recommendation

DSE recommends keeping two acceptance examples: one showing which lines belong to a single event, and another showing the expected event timestamp. Include a multiline error and an entry written earlier than collection. Ask the log owner to define the intended time interpretation before introducing a transformation. Do not conceal parsing failures by treating every resulting row as a complete event.

Verification

Compare the source entries with collected RawData and TimeGenerated. Confirm that continuation lines stay with the correct event and that any timestamp transformation produces the intended value. Repeat with a deliberately mismatched format in an isolated test to make the fallback visible. Preserve the examples and configuration together.

Official references

Microsoft Learn: Collect text files from virtual machines.