Generally Available: Azure Firewall now supports ingestion-time transformation in Log Analytics for flexible, cost-efficient logging

Azure Firewall now supports ingestion-time transformation of logs in Log Analytics, enabling selective logging and advanced filtering. 

Why it matters:
For customers using Log Analytics to analyse firewall logs, the cost of log ingestion and storage itself can be significant. This feature lets you filter and transform logs before ingestion, helping reduce costs while retaining critical data. 

Customer benefits: 

• Security monitoring: Log only suspicious traffic for better threat detection. 
• Cost savings: Avoid ingesting and storing unnecessary logs. 
• Compliance: Use DCRs to route logs for audit/reporting. 
• Incident response: Faster access to relevant logs. 
• Custom alerts: Build dashboards and alerts in Azure Monitor. 

Learn more: 

• About the firewall diagnostic logs that are available refer to Azure Firewall Resource Logs.
• Creating transformations in Log Analytics refer to Transformation in Log Analytics Workspace.