Attach an Azure Monitor transformation to the intended data flow

Source facts

Microsoft places the transformKql property within a DCR dataFlows entry that pairs a source with a destination. The transformation affects that particular data flow before delivery. Reusing the same stream or destination elsewhere in the rule does not extend the transformation to those other entries. Microsoft Learn.

Applicability

Apply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.

DSE recommendation

DSE recommends drawing the source-to-destination paths before editing the rule. Mark exactly which paths should receive the transformation and which should preserve the original record. Have a second reviewer compare that intent with the specific JSON location. Keep the prior rule and representative sanitized test records with the change record.

Verification

Submit distinguishable test records through each affected path in an approved environment. Query every destination and compare the stored fields with the expected result for that path. Confirm that an intentionally unchanged flow remains unchanged. Investigate discrepancies before rollout, and preserve both the deployed rule and the observed destination results.

Official references

Microsoft Learn: Create a transformation in Azure Monitor.