Azure Log Analytics Workspace delete container insights table

Question

I am trying to remove a bunch of logs that have been collected in a LAW from container insights, specifically a table named 'ContainerLogs'.
There seems to be some limitations to this table as it is managed by the container insights solution and has the type "Azure Table" resulting in data only being deleted after retention period has passed.

I have removed the solution and the container insights resource as well as uninstalled the monitor agent from the machines which were being monitored and can verify by looking at the logs that there have been no logs ingested since:

The table and data from the last 30 days is still in the workspace (not unexpected), but I cannot delete it.

I'm assuming that it will automatically be removed within 30 days if I leave it, but I would like to decrease the amount of stored data before that.
I realize that I could delete the entire workspace but as it is also collecting diagnostic settings from other resources I would prefer not to.

Mainly I'm just interested in finding out if there is a way to achieve what I'm trying to do here, otherwise I might have to take this limitation into consideration for how I set up our infrastructure.

Answer 1

The current data will be kept until the specified retention period ends, as you already mentioned. After a workaround on your issue, I found that the retention period is set and cannot be changed for the "Azure Table" type, which includes the "ContainerLogs" table from Azure Monitor for containers.

So, export the data from workspace to some file or folder. After exporting the data, you need to save, you can remove it from the workspace.

It can be done using below PowerShell script:

$start = "<User defined>"
$end = "<User defined>"
$query = "ContainerLogs | where TimeGenerated >= datetime('$start') and TimeGenerated <= datetime('$end')"
$resultdata = Search-AzOperationalInsightsQuery -WorkspaceId "/subscriptions/xxxx/resourcegroups/$resourceGroup/providers/microsoft.operationalinsights/workspaces/$ws" -Query $query
$resultdata.Results | Export-Csv -Path "path to download"
$dquery = "ContainerLogs | where TimeGenerated >= datetime('$start') and TimeGenerated <= datetime('$end') | summarize count() by bin(TimeGenerated, 1d)"
Invoke-AzOperationalInsightsQuery -WorkspaceId "/subscriptions/xxxx/resourcegroups/$resourceGroup/providers/microsoft.operationalinsights/workspaces/$ws" -Query $dquery