About correct use of Azure Log Analytics

Question

Hi every one,

I need your help to get to know which is the best or right way to use Azure Log Analytics

Use case 1

Monitor resources using the "Log" option to query via KQL

Use case 2

Concentrate logs in a unique Log Analytics Workspace via Azure Monitor

Best regards

Answer 1

Hi @Jona

So, here's the thing. You need to create diagnostic settings for any resource that will be queried in a log analytics workspace. Having said that, when you navigate to Logs after creating the diagnostic setting on a specific resource, the Logs pane is scoped to that specific resource. Whereas, when you're on the Logs pane of the analytics workspace, you are still scoped to that resource, but you can change the scope (by clicking Select scop) to a different resource.

Basically, you're navigating to the same "page", just with different parameters so to speak. There isn't a specific correct use when it comes navigating but what's more important is getting Azure Monitor configured correctly. Just remember that each resource type will have different logging tables, so scoping becomes important so that the query editor has the right tables you write your queries against.