Managing Query Packs

Question

• From within Portal: If you want to save a Logs Analytics KQL Query you are already default invited to save it to a 'Query Pack'.
• The path to this query pack can either be that of a/the 'default' query pack, or one you have created previously.

In a scenario where you may over time have accumulated multiple query packs, where among those query packs, is there no convenient way to continue to curate and maintain those query packs?

For example:

• you may have created different queries, under the same oversimplified name, saved to different query packs.
• Lets say you want to consolidate, and reduce those query packs

How do you explore your query packs? See what query names they contain? See what queries they contain?

As far as I can tell your nearest option would be to:

• arbitrarily pick some, perhaps Log Analytics Workspace resource that has nothing to do with the exercise.
• Compromise it by under logs select all of your hundred Query packs.
• Under 'other' Scroll through all the queries un, including those that have nothing to do with any query pack.
• Accept that at this level there is no indication or hint as to what Query pack they belong to.
• Hover over each query to find out what query pack they belong to.
• Explicitly retrieve/load each query into the space of the arbitrary resource's Log blade just to view the query itself.

There is 'Log Analytics query packs', but while I accept this is in preview, the use of query packs is very much not. This only facilitates the creation of new empty query packs, and the finding and listing of query pack names, and the deletion of query packs singular or batch.
If you go into a query pack, it has no blades that provide any functionality specific to query packs. Its overview provides only basic common ARM level resource information.

As far as I can tell there is no documentation that alludes to other tools.
This is it https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-packs

Is there any tooling that facilitates the kind of needs I've described?

Answer 1

Hello Anthony Lee Thank you for posting your query on Microsoft Q&A platform.

Currently, Azure Monitor does not provide any portal‑based tooling to manage, explore, or consolidate queries inside Query Packs. The Azure Portal only supports creating, deleting, and assigning permissions to Query Packs. It does not support:

• Browsing queries within a query pack
• Listing query names per query pack
• Identifying query‑to‑query‑pack association at scale
• Moving or consolidating queries between query packs

This is by design based on current product capabilities and is not documented as a supported scenario.

Query Packs are treated as ARM container resources and that the portal experience is limited to basic management only:

“Query packs act as containers for log queries in Azure Monitor. You can view and manage query packs in the Azure portal from the Log Analytics query packs menu.”

The documentation does not describe any UI capability to list, browse, export, or consolidate queries inside a query pack.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-packs

The Log Analytics Query Packs blade (currently in preview) only allows:

• Creating new query packs
• Listing existing query pack resources
• Deleting query packs

It does not provide any query‑level visibility or management functionality.

The only supported way to explore or consolidate queries across query packs is via the Azure Resource Manager (ARM) / REST API, where queries are exposed as child resources of a query pack.

Microsoft documents this API‑based approach, including:

• Creating query packs
• Creating or updating queries inside a query pack
• Managing query definitions programmatically

There is no Microsoft‑provided UI tool for query‑level governance or consolidation.

There is no portal‑based or built‑in Microsoft tool that fulfills the query‑pack curation and consolidation scenario described. If centralized governance or consolidation is required, it must be implemented programmatically using the Query Packs ARM/REST API. Otherwise, the current portal behavior is the expected.

Thanks,
Suchitra.