About correct use of Azure Log Analytics

Jona 375 Reputation points
2023-10-18T17:34:23.4033333+00:00

Hi every one,

I need your help to get to know which is the best or right way to use Azure Log Analytics

Use case 1

Monitor resources using the "Log" option to query via KQL

log-question-01

log-question-02

Use case 2

Concentrate logs in a unique Log Analytics Workspace via Azure Monitor

log-question-03

log-question-04

log-question-05

Best regards

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,856 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Ryan Hill 26,236 Reputation points Microsoft Employee
    2023-10-27T16:58:26.81+00:00

    Hi @Jona

    So, here's the thing. You need to create diagnostic settings for any resource that will be queried in a log analytics workspace. Having said that, when you navigate to Logs after creating the diagnostic setting on a specific resource, the Logs pane is scoped to that specific resource. Whereas, when you're on the Logs pane of the analytics workspace, you are still scoped to that resource, but you can change the scope (by clicking Select scop) to a different resource.

    Basically, you're navigating to the same "page", just with different parameters so to speak. There isn't a specific correct use when it comes navigating but what's more important is getting Azure Monitor configured correctly. Just remember that each resource type will have different logging tables, so scoping becomes important so that the query editor has the right tables you write your queries against.