Azure Monitor data is queried using the Kusto Query Language (KQL). KQL is designed to be easy to author, read, and automate. With KQL, you can analyze large volumes of data for your diagnostics, monitoring, and reporting needs. In this guide, you will learn how to perform some common queries in KQL, including how to query telemetry in structured and semi-structured data.
Broadly, Azure Monitor captures three types of data from your Azure Resources. These include:
To start querying this data from the Azure Portal, navigate to the Azure Monitor resource and click on the Logs blade. Once open, select a scope for your query. You can choose between querying the Azure Monitor logs for your entire subscription, a resource group, or a specific resource.
Azure Activity provides details on management activities and includes information on who, what, and when resources have changed. With the Logs blade open, you can start querying data.
Access the data through the
Filter the results by appending
The following code snippets show some examples of how to query this table and filter the results:
1// filter azure activity by a specific user 2AzureActivity 3| where Caller == "[email protected]" 4 5// filter azure activity by resource type 6AzureActivity 7| where ResourceProviderValue == "Microsoft.Web" 8 9// check if any app service plan scaled to 5 instances or more 10AzureActivity 11| where OperationName == "Autoscale scale up initiated" 12| where parse_json(Properties).NewInstancesCount >= 5
Some Azure services can log diagnostic telemetry that is unique to the service. Microsoft's documentation on What is monitored by Azure Monitor? provides details on which services are supported. These diagnostic logs also need to be enabled separately.
This section will use an Azure SQL database to demonstrate some of the information you can query from Azure Monitor.
You can run the following query to get an overview of the diagnostic logs available in your own workspace.
1AzureDiagnostics 2| summarize count() by ResourceType, OperationName
1| ResourceType | OperationName | Count | 2| SERVERS/DATABASES | QueryStoreWaitStatisticsEvent | 100 | 3| SERVERS/DATABASES | DatabaseWaitStatistcsEvent | 110 | 4| SERVERS/DATABASES | QueryStoreRuntimeStatisticsEvent | 1000 | 5| SERVERS/DATABASES | AutomaticTuningSettingsSnapshotEvent | 100 | 6| SERVERS/DATABASES | ErrorEvent | 100 |
Microsoft's documentation on Azure SQL Database Diagnostic telemetry for export provides more details on what each of these events represent.
From here, you can narrow to a specific operation type and service.
1AzureDiagnostics 2| where OperationName == 'ErrorEvent' 3| summarize count() by Message, DatabaseName_s, LogicalServerName_s
This query summarizes the number of errors by database. You can also change the time range to drill down to a specific event.
Note that some properties end with
This tells you the type of data stored in that column where
_s is string,
_d is double, and
_t is timestamp.
Azure Monitor provides a rich set of capabilities for capturing, querying, alerting, and monitoring your Azure resources. The queries you write will depend on what Azure resources you are currently using. You can read more in the Microsoft documentation about What is Monitored by Azure Monitor and the Kusto Query Language to get more insights into how your Azure subscription is operating.