data-source/azure-monitor

25 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Azure Monitor Logs example: table query

This example query returns rows with six specified columns for use with the Table panel: ```kusto AzureActivity | where $__timeFilter() | project TimeGenerated, ResourceGroup, Category, OperationName, ActivityStatus, Caller | order by TimeGenerated desc ```

Azure Resource Graph definition

Azure Resource Graph (ARG) is an Azure service designed to extend Azure Resource Management with efficient resource exploration and the ability to query at scale across a set of subscriptions. It allows querying resources with complex filtering, iteratively exploring resources based on governance requirements, and assessing the impact of applying policies.

Azure Monitor query editor access

The Azure Monitor query editor is located on the Explore page. You can also access it from a dashboard panel by clicking the menu in the upper right of the panel and selecting Edit.

Azure Monitor data sources queryable

The Azure Monitor data source can query data from Azure Monitor Metrics and Logs, the Azure Resource Graph, and Application Insights Traces. Each source has its own specialized query editor.

KQL (Kusto Query Language) definition

KQL is the query language used for Azure Monitor Logs and Azure Resource Graph. It uses a pipe-based syntax similar to Unix commands and is optimized for read-only data exploration. The SQL to Kusto cheat sheet can help SQL users get started.

Azure Monitor Metrics vs Logs

Metrics are lightweight numeric values collected at regular intervals such as CPU percentage. Logs are detailed records of events with varying schemas such as request logs and error messages. Metrics use a visual query builder; Logs require KQL.

Azure Monitor query editor modes

The Azure Monitor data source query editor has four modes: Metrics for Azure Monitor Metrics, Logs for Azure Monitor Logs, Traces for Application Insights Traces, and Azure Resource Graph for Azure Resource Graph.

Azure Monitor Metrics query creation steps

To create a Metrics query: (1) Select the Azure Monitor data source. (2) Select the Metrics service. (3) Select a resource using subscription, resource group, resource type, and resource fields; multiple resources can be selected if they belong to the same subscription, region, and resource type. (4) Optionally use the Namespace option to select resources organized under multiple namespaces. (5) Select a metric from the Metric field. (6) Optionally apply aggregations, specify custom time grain, or filter by dimensions.

Azure Monitor Metrics legend alias patterns

Legend aliases for Metrics can use the following patterns: {{ subscriptionid }} replaced with subscription ID; {{ subscription }} replaced with subscription name; {{ resourcegroup }} replaced with resource group; {{ namespace }} replaced with resource type or namespace such as Microsoft.Compute/virtualMachines; {{ resourcename }} replaced with resource name; {{ metric }} replaced with metric name such as Percentage CPU; {{ arbitraryDimensionID }} replaced with the value of the specified dimension such as {{ blobtype }} becomes BlockBlob; {{ dimensionname }} (legacy for backward compatibility) replaced with the name of the first dimension; {{ dimensionvalue }} (legacy for backward compatibility) replaced with the value of the first dimension.

Azure Monitor Metrics dimensions filtering

Dimensions are key-value pairs assigned to each value of a metric and can be used to filter metrics. The data source supports the equals, not equals, and starts with operators for dimension filtering as detailed in the Monitor Metrics API documentation.

Azure Monitor Logs query creation steps

To create a Logs query: (1) Select the Azure Monitor data source. (2) Select the Logs service. (3) Select a resource to query; multiple resources can be selected as long as they are of the same type. Alternatively, dynamically query all resources under a single resource group or subscription. (4) Enter your KQL query. If a time span is specified in the query, the overlap between the query time span and the dashboard time range is used.

Azure Monitor Basic Logs support

The Azure Monitor data source supports querying Basic Logs tables if they exist in the Log Analytics workspace. This feature must be enabled in the data source configuration. Basic Logs queries have restrictions: time range uses the dashboard time range only; only a single Log Analytics workspace can be queried; Basic Logs queries are not available when creating alert rules; and some KQL operators are not supported.

Azure Monitor Logs query builder public preview

The Logs query builder provides a visual interface for building Azure Monitor Logs queries without writing KQL. It is a public preview feature that may not be enabled in all Grafana environments. To enable it, set the azureMonitorLogsBuilderEditor feature toggle in Grafana configuration and restart Grafana. When enabled, a Builder / Code toggle appears in the Logs query editor. Builder mode uses a visual interface; Code mode writes KQL directly. New queries default to Builder mode; existing queries remain in Code mode.

Azure Monitor Logs macros

The following Grafana macros can be used in Azure Monitor Logs queries: $__timeFilter() filters results to the dashboard time range, example: TimeGenerated >= datetime(2018-06-05T18:09:58.907Z) and TimeGenerated <= datetime(2018-06-05T20:09:58.907Z); $__timeFilter(datetimeColumn) filters on a custom field; $__timeFrom() returns the start of the dashboard time range, example: datetime(2018-06-05T18:09:58.907Z); $__timeTo() returns the end of the dashboard time range, example: datetime(2018-06-05T20:09:58.907Z); $__escapeMulti($myVar) escapes illegal characters in multi-value template variables, example: if $myVar has values '\\grafana-vm\Network(eth0)\Total','\\hello!' it expands to @'\\grafana-vm\Network(eth0)\Total', @'\\hello!'; $__contains(colName, $myVar) expands multi-value template variables, example: if $myVar has value 'value1','value2' it expands to colName in ('value1','value2'), and if $myVar has value 'all' it expands to 1 == 1.

Azure Monitor Logs query time range behavior

The time range used for Logs queries can be modified via the time-range switch: selecting Query uses only time-ranges specified within the query; selecting Dashboard uses only the Grafana dashboard time-range; if no time-range is specified in the query, the default Log Analytics time-range applies. Previously used Intersection option has been migrated to Dashboard.

Azure Monitor Logs example: CPU performance time series

This example query returns a virtual machine's CPU performance, averaged over 5-minute time grains: ```kusto Perf // $__timeFilter is a special Grafana macro that filters the results to the time span of the dashboard | where $__timeFilter(TimeGenerated) | where CounterName == "% Processor Time" | summarize avg(CounterValue) by bin(TimeGenerated, 5m), Computer | order by TimeGenerated asc ``` Use time series queries for values that change over time, usually for graph visualizations. Each query should return at least a datetime column and numeric value column, and the result must be sorted in ascending order by the datetime column.

Azure Monitor Logs example: aggregated count with dimensions

This example query returns the aggregated count grouped by hour, Computer, and CounterName: ```kusto Perf | where $__timeFilter(TimeGenerated) | summarize count() by bin(TimeGenerated, 1h), Computer, CounterName | order by TimeGenerated asc ``` Queries can include at least one non-numeric, non-datetime column which Azure Monitor considers as dimensions that become labels in the response.

Azure Monitor Logs example: multiple numeric columns with dimensions

This example query returns a count and average value by hour, Computer, CounterName, and InstanceName: ```kusto Perf | where $__timeFilter(TimeGenerated) | summarize Samples=count(), ["Avg Value"]=avg(CounterValue) by bin(TimeGenerated, $__interval), Computer, CounterName, InstanceName | order by TimeGenerated asc ```

Azure Resource Graph query creation

ARG queries are written in a variant of Kusto Query Language (KQL), but not all Kusto language features are available in ARG. An Azure Resource Graph query is formatted as table data. If credentials grant access to multiple subscriptions, multiple subscriptions can be chosen before entering queries. It is also possible to run queries against the directory by changing the query scope.

Azure Resource Graph macros

The following Grafana macros can be used in Azure Resource Graph queries: $__timeFilter() expands to timestamp ≥ datetime(2018-06-05T18:09:58.907Z) and timestamp ≤ datetime(2018-06-05T20:09:58.907Z); $__timeFilter(datetimeColumn) expands with a custom datetime column; $__timeFrom() returns the start of the dashboard time range from the Grafana picker, example: datetime(2018-06-05T18:09:58.907Z); $__timeTo() returns the end of the dashboard time range, example: datetime(2018-06-05T20:09:58.907Z); $__escapeMulti($myVar) escapes illegal characters from multi-value template variables, example: if $myVar has values '\\grafana-vm\Network(eth0)\Total','\\hello!' it expands to @'\\grafana-vm\Network(eth0)\Total', @'\\hello!'; $__contains(colName, $myVar) expands multi-value template variables, example: if $myVar has value 'value1','value2' it expands to colName in ('value1','value2').

Azure Resource Graph example: sort by resource properties

This example query returns all resources in the selected subscriptions with only name, type, and location properties: ```kusto Resources | project name, type, location | order by name asc ``` The query uses order by to sort properties in ascending order and project to show only the listed properties.

Azure Resource Graph example: filter by tag

This example query returns a list of resources with an environment tag value of Internal: ```kusto Resources | where tags.environment=~'internal' | project name ``` The query uses =~ in the type match to make the query case-insensitive.

Azure Resource Graph example: group and aggregate by property

This example query returns counts of healthy, unhealthy, and not applicable resources per recommendation: ```kusto securityresources | where type == 'microsoft.security/assessments' | extend resourceId=id, recommendationId=name, resourceType=type, recommendationName=properties.displayName, source=properties.resourceDetails.Source, recommendationState=properties.status.code, description=properties.metadata.description, assessmentType=properties.metadata.assessmentType, remediationDescription=properties.metadata.remediationDescription, policyDefinitionId=properties.metadata.policyDefinitionId, implementationEffort=properties.metadata.implementationEffort, recommendationSeverity=properties.metadata.severity, category=properties.metadata.categories, userImpact=properties.metadata.userImpact, threats=properties.metadata.threats, portalLink=properties.links.azurePortal | summarize numberOfResources=count(resourceId) by tostring(recommendationName), tostring(recommendationState) ``` In ARG, many nested properties are of a dynamic type and should be cast to a string with tostring() to operate on them.

Azure Application Insights Traces query creation steps

To create a Traces query: (1) Select the Azure Monitor data source. (2) Select the Traces service. (3) Select a resource to query; multiple resources can be selected if they are of the same type. This query type only supports Application Insights resources. (4) Optionally specify an Operation ID value to filter traces. (5) Optionally specify event types to filter by. (6) Optionally specify event properties to filter by. (7) Optionally change the Result format to switch between tabular format and trace format. Selecting trace format filters events to only the trace type and should be used with the Trace visualization.

Azure Monitor large dataset pagination

If a request exceeds the maximum allowed value of records for Azure Resource Graph, the result is paginated and only the first page of results are returned. Filters can be used to reduce the amount of records returned under that limit.

Give your agent this brain