Querying Log Analytics

It can be useful to explore your logs in Log Analytics. Being able to query Log Analytics requires an understanding of Kusto Query Language (KQL). We will explore some basic queries in this exercise to understand how the system works.

Creating a Log Analytics workspace

Before we can display, monitor, and query logs from Azure Monitor, we need to create a Log Analytics workspace. For that, we must perform the following steps:

1. Navigate to the Azure portal by clicking on https://portal.azure.com.
2. Navigate to your AZ104-Monitor resource group.
3. Click + Create to create a new resource.
4. Type log analytics in the search box and click Log Analytics Workspace:

Figure 20.32 – Log Analytics Workspace

5. Click Create.
6. Add the following values:
   • Subscription: Select your Azure subscription.
   • Resource group: AZ104-Monitor.
   • Name: az104loganalytics.
   • Region: West Europe (or select what you prefer).
7. Click Review...