How to call rest api from loganalytics workspace to query Usages - List By Vaults api

Question

Hi Friends,

Can any one guide me how to use below api from backup log analytics workspace to get the answer.

Also do we have option to send a mail from workspace? like alerts once configured.

Usages - List By Vaults

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/usages?api-version=2025-02-01

Answer 1

Hi Siva, thanks for reaching out Microsoft Q&A

Log Analytics workspaces (Kusto) cannot directly call external REST APIs. The query engine only works against ingested data already in your workspace.

If you want to bring Backup Vault usage data into your Log Analytics workspace, you have two options to follow

Call REST API from Log Analytics Workspace

• First, register an application in Azure AD, assign it the Log Analytics Reader role on the target workspace, and create a client secret. Then, use the app’s client ID, secret, and tenant ID to request an OAuth2 token from Azure AD’s token endpoint, specifying https://api.loganalytics.azure.com as the resource.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/register-app-for-token?tabs=portal

• To query Log Analytics through the REST API, use the endpoint https://api.loganalytics.azure.com/v1/workspaces/{workspaceId}/query and authenticate with a bearer token obtained via Microsoft Entra ID (OAuth2 client credentials flow.
• You then send your Kusto query in JSON format (e.g., { "query": "Usage" }) in a POST request, including the token in the Authorization header.
• The Usages – List By Vaults API is specific to Azure Backup. Vault usage metrics can be obtained directly in Log Analytics by running the right Kusto queries against data already ingested into the workspace.
• Alternatively, you can call the Azure Backup REST API (a separate endpoint) using an Azure AD token for authentication, and if you want to integrate those results with Log Analytics, you can push the retrieved backup data into the workspace for querying.

Refer document: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api?tabs=rest

Sending Email or Alerts from Log Analytics Workspace

• Sending emails directly from a Log Analytics workspace isn’t supported. Instead, you can create alert rules on your Log Analytics queries and attach action groups, which handle the notifications. Action groups let you send emails, SMS, or trigger webhooks when the alert condition is met, ensuring query results automatically generate the required notifications.

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview

As Divyesh Govaerdhanan mentioned you can also use

• A Logic App or Azure Function to call the Usages - ListByVaults REST API and push the results into your Log Analytics workspace through the Data Collector API. Since Kusto cannot make REST calls directly, the data must be ingested either via diagnostic settings or a custom pipeline before you can query it.

https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/logs/data-collector-api?utm_source

I hope the provided answer is helpful, do let me know if you have any further questions on this Please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Answer 2

Hello,

Welcome to Microsoft Q&A,

We can't call REST API from an Log Analytics KQL Query. KQL has no HTTP client. You need an external runner (Logic App / Function / Automation) to call the API, then (optionally) push the results into your workspace where you can query/alert on them.

Option 1: Logic App - Call the ARM endpoint on a schedule, email the results, and/or write them to Log Analytics.

https://docs.azure.cn/en-us/azure-monitor/logs/tutorial-logs-ingestion-api?tabs=dcr

Option 2: Azure Function / Automation Runbook

Acquire token with managed identity → GET the Usages endpoint → email or write to Log Analytics using the Logs Ingestion API. (Useful if you prefer code over a designer.)

Please Upvote and accept the answer if it helps!!