Edit

Azure Monitor Logs connector for Logic Apps and Power Automate

  • Article
  • 4 minutes to read

Azure Logic Apps and Power Automate allow you to create automated workflows using hundreds of actions for various services. The Azure Monitor Logs connector allows you to build workflows that retrieve data from a Log Analytics workspace or an Application Insights application in Azure Monitor. This article describes the actions included with the connector and provides a walkthrough to build a workflow using this data.

For example, you can create a logic app workflow to use Azure Monitor log data in an email notification from Office 365, create a bug in Azure DevOps, or post a Slack message. You can trigger a workflow by a simple schedule or from some action in a connected service such as when a mail or a tweet is received.

Connector limits

The Azure Monitor Logs connector has these limits:

  • Max query response size: ~16.7 MB (16 MiB). The connector infrastructure dictates that size limit is set lower than query API limit.
  • Max number of records: 500,000.
  • Max connector timeout: 110 seconds.
  • Max query timeout: 100 seconds.
  • Visualizations in the Logs page and the connector use different charting libraries and some functionality isn't available in the connector currently.

The connector may reach limits depending on the query you use and the size of the results. You can often avoid such cases by adjusting the flow recurrence to run more frequent on smaller time range, or aggregate data to reduce the results size. Frequent queries with lower intervals than 120 seconds aren’t recommended due to caching.

Actions

The following table describes the actions included with the Azure Monitor Logs connector. Both allow you to run a log query against a Log Analytics workspace or Application Insights application. The difference is in the way the data is returned.

Note

The Azure Monitor Logs connector replaces the Azure Log Analytics connector and the Azure Application Insights connector. This connector provides the same functionality as the others and is the preferred method for running a query against a Log Analytics workspace or an Application Insights application.

Action Description
Run query and and list results Returns each row as its own object. Use this action when you want to work with each row separately in the rest of the workflow. The action is typically followed by a For each activity.
Run query and and visualize results Returns a JPG file that depicts the query result set. This action lets you use the result set in the rest of the workflow by sending the results in an email, for example. The action only returns a JPG file if the query returns results.

Walkthroughs

The following tutorial illustrates the use of the Azure Monitor Logs connector in Azure Logic Apps. You can perform the same tutorial with Power Automate, the only difference being how you create the initial workflow and run it when complete. You configure the workflow and actions in the same way for both Logic Apps and Power Automate. See Create a flow from a template in Power Automate to get started.

Create a Logic App

  1. Go to Logic Apps in the Azure portal and select Add.

  2. Select a Subscription, Resource group, and Region to store the new logic app and then give it a unique name. You can turn on the Log Analytics setting to collect information about runtime data and events as described in Set up Azure Monitor logs and collect diagnostics data for Azure Logic Apps. This setting isn't required for using the Azure Monitor Logs connector.

    Screenshot that shows the Basics tab on the logic app creation screen.

  3. Select Review + create > Create.

  4. When the deployment is complete, select Go to resource to open the Logic Apps Designer.

Create a trigger for the logic app workflow

  1. Under Start with a common trigger, select Recurrence.

    This creates a logic app workflow that automatically runs at a regular interval.

  2. In the Frequency box of the action, select Day and in the Interval box, enter 1 to run the workflow once per day.

    Screenshot that shows the Logic Apps Designer "Recurrence" window on which you can set the interval and frequency at which the logic app runs.

Walkthrough: Mail visualized results

This tutorial shows how to create a logic app workflow that sends the results of an Azure Monitor log query by email.

Add Azure Monitor Logs action

  1. Select + New step to add an action that runs after the recurrence action.

  2. Under Choose an action, type azure monitor and then select Azure Monitor Logs.

    Screenshot that shows the Logic App Designer "Choose an action" window.

  3. Select Azure Log Analytics – Run query and visualize results.

    Screenshot of a new action being added to a step in the Logic Apps Designer. Azure Monitor Logs is highlighted under Choose an action.

Add Azure Monitor Logs action

  1. Select the Subscription and Resource Group for your Log Analytics workspace.

  2. Select Log Analytics Workspace for the Resource Type and then select the workspace's name under Resource Name.

  3. Add the following log query to the Query window.

    Event
| where EventLevelName == "Error" 
| where TimeGenerated > ago(1day)
| summarize TotalErrors=count() by Computer
| sort by Computer asc

  4. Select Set in query for the Time Range and HTML Table for the Chart Type.

    Screenshot of the settings for the new Azure Monitor Logs action named Run query and visualize results.

    The account associated with the current connection sends the email. To specify another account, select Change connection.

Add email action

  1. Select + New step > + Add an action.

  2. Under Choose an action, type outlook and then select Office 365 Outlook.

    Screenshot that shows the Logic App Designer "Choose an action" window with the Office 365 Outlook button highlighted.

  3. Select Send an email (V2).

    Screenshot of a new action being added to a step in the Logic Apps Designer. Send an email (V2) is highlighted under Choose an action.

  4. Click anywhere in the Body box to open a Dynamic content window opens with values from the previous actions in the logic app.

  5. Select See more and then Body which is the results of the query in the Log Analytics action.

    Screenshot of the settings for the new Send an email (V2) action, showing the body of the email being defined.

  6. Specify the email address of a recipient in the To window and a subject for the email in Subject.

    Screenshot of the settings for the new Send an email (V2) action, showing the subject line and email recipients being defined.

Save and test your workflow

  1. Select Save and then Run to perform a test run of the workflow.

    Save and run

    When the workflow completes, check the mail of the recipient that you specified. You should receive a mail with a body similar to the following:

    An image of a sample email.

    Note

    The workflow generates an email with a JPG file that depicts the query result set. If your query doesn't return results, the workflow won't create a JPG file.

Next steps