Azure Monitor is now integrated with the features and capabilities that Log Analytics was offering. This also includes creating search queries across the different logs and metrics by using the Kusto query language.
To retrieve any type of data from Azure Monitor, a query is required. Whether you are configuring an alert rule, analyzing data in the Azure portal, retrieving data using the Azure Monitor Logs API, or being notified of a particular condition, a query is used.
The following list provides an overview of all of the different ways queries are used by Azure Monitor:
- Portal: From the Azure portal, interactive analysis of log data can be performed. In there, you can create and edit queries and analyze the results in a variety of formats and visualizations.
- Dashboards: The results of a query can be pinned to a dashboard. This way, results can be visualized and shared with other users.
- Views: By using the View Designer in Azure Monitor, you can create custom views of your data. This data is provided by queries as well.
- Alert rules: Alert rules are also made up of queries.
- Export: Exports of data to Excel or Power BI are created with queries. The query defines the data to export.
- Azure Monitor Logs API: The Azure Monitor Logs API allows any REST API client to retrieve log data from the workspace. The API request includes a query to retrieve the data.
- PowerShell: You can run a PowerShell script from a command line or an Azure Automation runbook that uses Get-AzOperationalInsightsSearchResults to retrieve log data from Azure Monitor. You need to create a query for this cmdlet to retrieve the data.
In the following section, we are going to create some queries to retrieve data from the logs in Azure Monitor.
Querying logs in Azure Monitor
To query logs in Azure Monitor, perform the following steps:
- Navigate to the Azure portal by opening https://portal.azure.com.
- In the left-hand menu, select Monitor to open the Azure Monitor overview blade. Under Insights, select More. This will open the Log Analytics workspace that we created in the previous step.
- On the overview page, click on Logs in the top menu. This will open the Azure Monitor query editor:
Azure Monitor query editor
- Here, you can select some default queries. They are displayed at the bottom part of the screen. There are queries for retrieving unavailable computers, the last heartbeat of a computer, and much more. Add the following queries to the query editor window to retrieve data:
-
- This query will retrieve the top 10 computers with the most error events over the last day:
Event | where (EventLevelName == "Error") | where (TimeGenerated > ago(1days)) | summarize ErrorCount = count() by Computer | top 10 by ErrorCount desc
-
- This query will create a line chart with the processor utilization for each computer from the last week:
Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" | where TimeGenerated between (startofweek(ago(7d)) .. endofweek(ago(7d)) ) | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5min) | render timechart
A detailed overview and tutorial on how to get started with the Kusto query language are beyond the scope of this book. If you want to find out more about this query language, you can refer to https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-queries.
