Sample Log Analytics queries are just wrong

Question

When I go to logs in the Azure Portal for the Firewall and it drops me into Log Analytics, but the sample queries don't work. This is really poor quality and I don't understand why it's allowed to happen. As a user of the service I shouldn't have to debug the queries you provide to get my log data.

Answer 1

@JohnSebastian-3934

Thank you for getting back.

Based on your response above.

If I click on the Logs menu item, I first am presented with this annoying Azure Monitor Log Analytics video that I have to dismiss. Next a Queries screen appears. There are two types of queries listed. Firewall Logs and Firewall Logs (Resour...) I have no idea which is which. I'll assume that Firewall Logs is some original logs queries before the Structured Firewall Logs is turned on. I can't tell though because what is displayed on the screen for queries does not say something like Original Firewall Logs and New Structured Firewall Logs. I don't know who reviews the UI but if you're going to refer to things in your documentation with terms like "Structured Firewall Logs" then the least you can do for customers is use the same terminology on the Queries screen so that it is obvious what we are querying.

I understand the confusion caused. I will share this feedback with the product team, and it will also help if you could log this feedback on our feedback portal here.

So assuming that the Firewall Logs (Resour... list of queries is what you mean to be Structured Firewall Logs queries, it appears that the provided queries are working properly now. I'm not sure why at this point but the sample queries provided under the Firewall Logs queries are also working. I don't know if someone fixed the queries that are generated and auto loaded but I can tell you that when I opened this ticket, these queries were throwing syntax Kusto Syntax errors.

Glad to know you were able to execute the queries now. We have usually observed such issues because sometimes it takes time (Usually few hours) for diagnostic logs populate in the log analytics workspace. This might be a likely cause here.

Please let me know if you have any additional questions. Thank you!