Microsoft.OperationalInsights queryPacks/queries

Bicep resource definition

The queryPacks/queries resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Usage Examples

Bicep Samples

A basic example of deploying Log Analytics Query Pack Query.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource queryPack 'Microsoft.OperationalInsights/queryPacks@2019-09-01' = {
  name: resourceName
  location: location
  properties: {}
}

resource query 'Microsoft.OperationalInsights/queryPacks/queries@2019-09-01' = {
  name: 'aca50e92-d3e6-8f7d-1f70-2ec7adc1a926'
  parent: queryPack
  properties: {
    body: '''    let newExceptionsTimeRange = 1d;
    let timeRangeToCheckBefore = 7d;
    exceptions
    | where timestamp < ago(timeRangeToCheckBefore)
    | summarize count() by problemId
    | join kind= rightanti (
        exceptions
        | where timestamp >= ago(newExceptionsTimeRange)
        | extend stack = tostring(details[0].rawStack)
        | summarize count(), dcount(user_AuthenticatedId), min(timestamp), max(timestamp), any(stack) by problemId
    ) on problemId
    | order by count_ desc
'''
    displayName: 'Exceptions - New in the last 24 hours'
    related: {}
  }
}

Resource format

To create a Microsoft.OperationalInsights/queryPacks/queries resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.OperationalInsights/queryPacks/queries@2025-07-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    body: 'string'
    description: 'string'
    displayName: 'string'
    properties: any(...)
    related: {
      categories: [
        'string'
      ]
      resourceTypes: [
        'string'
      ]
      solutions: [
        'string'
      ]
    }
    tags: {
      {customized property}: [
        'string'
      ]
    }
  }
}

Property Values

Microsoft.OperationalInsights/queryPacks/queries

Name Description Value
name The resource name string (required)
parent In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource.

For more information, see Child resource outside parent resource.		 Symbolic name for resource of type: queryPacks
properties Properties that define an Log Analytics QueryPack-Query resource. LogAnalyticsQueryPackQueryProperties

LogAnalyticsQueryPackQueryProperties

Name Description Value
body Body of the query. string (required)
description Description of the query. string
displayName Unique display name for your query within the Query Pack. string (required)
properties Additional properties that can be set for the query. any
related The related metadata items for the function. LogAnalyticsQueryPackQueryPropertiesRelated
tags Tags associated with the query. LogAnalyticsQueryPackQueryPropertiesTags

LogAnalyticsQueryPackQueryPropertiesRelated

Name Description Value
categories The related categories for the function. string[]
resourceTypes The related resource types for the function. string[]
solutions The related Log Analytics solutions for the function. string[]

LogAnalyticsQueryPackQueryPropertiesTags

Name Description Value

ARM template resource definition

The queryPacks/queries resource type can be deployed with operations that target:

Usage Examples

Resource format

To create a Microsoft.OperationalInsights/queryPacks/queries resource, add the following JSON to your template.

{
  "type": "Microsoft.OperationalInsights/queryPacks/queries",
  "apiVersion": "2025-07-01",
  "name": "string",
  "properties": {
    "body": "string",
    "description": "string",
    "displayName": "string",
    "properties": {},
    "related": {
      "categories": [ "string" ],
      "resourceTypes": [ "string" ],
      "solutions": [ "string" ]
    },
    "tags": {
      "{customized property}": [ "string" ]
    }
  }
}

Property Values

Microsoft.OperationalInsights/queryPacks/queries

Name Description Value
apiVersion The api version '2025-07-01'
name The resource name string (required)
properties Properties that define an Log Analytics QueryPack-Query resource. LogAnalyticsQueryPackQueryProperties
type The resource type 'Microsoft.OperationalInsights/queryPacks/queries'

LogAnalyticsQueryPackQueryProperties

Name Description Value
body Body of the query. string (required)
description Description of the query. string
displayName Unique display name for your query within the Query Pack. string (required)
properties Additional properties that can be set for the query. any
related The related metadata items for the function. LogAnalyticsQueryPackQueryPropertiesRelated
tags Tags associated with the query. LogAnalyticsQueryPackQueryPropertiesTags

LogAnalyticsQueryPackQueryPropertiesRelated

Name Description Value
categories The related categories for the function. string[]
resourceTypes The related resource types for the function. string[]
solutions The related Log Analytics solutions for the function. string[]

LogAnalyticsQueryPackQueryPropertiesTags

Name Description Value

Terraform (AzAPI provider) resource definition

The queryPacks/queries resource type can be deployed with operations that target:

  • Resource groups For a list of changed properties in each API version, see change log.

Usage Examples

Terraform Samples

A basic example of deploying Log Analytics Query Pack Query.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "queryPack" {
  type      = "Microsoft.OperationalInsights/queryPacks@2019-09-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
    }

  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "query" {
  type      = "Microsoft.OperationalInsights/queryPacks/queries@2019-09-01"
  parent_id = azapi_resource.queryPack.id
  name      = "aca50e92-d3e6-8f7d-1f70-2ec7adc1a926"
  body = {
    properties = {
      body        = "    let newExceptionsTimeRange = 1d;\n    let timeRangeToCheckBefore = 7d;\n    exceptions\n    | where timestamp < ago(timeRangeToCheckBefore)\n    | summarize count() by problemId\n    | join kind= rightanti (\n        exceptions\n        | where timestamp >= ago(newExceptionsTimeRange)\n        | extend stack = tostring(details[0].rawStack)\n        | summarize count(), dcount(user_AuthenticatedId), min(timestamp), max(timestamp), any(stack) by problemId\n    ) on problemId\n    | order by count_ desc\n"
      displayName = "Exceptions - New in the last 24 hours"
      related = {
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

Resource format

To create a Microsoft.OperationalInsights/queryPacks/queries resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.OperationalInsights/queryPacks/queries@2025-07-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      body = "string"
      description = "string"
      displayName = "string"
      properties = ?
      related = {
        categories = [
          "string"
        ]
        resourceTypes = [
          "string"
        ]
        solutions = [
          "string"
        ]
      }
      tags = {
        {customized property} = [
          "string"
        ]
      }
    }
  }
}

Property Values

Microsoft.OperationalInsights/queryPacks/queries

Name Description Value
name The resource name string (required)
parent_id The ID of the resource that is the parent for this resource. ID for resource of type: queryPacks
properties Properties that define an Log Analytics QueryPack-Query resource. LogAnalyticsQueryPackQueryProperties
type The resource type "Microsoft.OperationalInsights/queryPacks/queries@2025-07-01"

LogAnalyticsQueryPackQueryProperties

Name Description Value
body Body of the query. string (required)
description Description of the query. string
displayName Unique display name for your query within the Query Pack. string (required)
properties Additional properties that can be set for the query. any
related The related metadata items for the function. LogAnalyticsQueryPackQueryPropertiesRelated
tags Tags associated with the query. LogAnalyticsQueryPackQueryPropertiesTags

LogAnalyticsQueryPackQueryPropertiesRelated

Name Description Value
categories The related categories for the function. string[]
resourceTypes The related resource types for the function. string[]
solutions The related Log Analytics solutions for the function. string[]

LogAnalyticsQueryPackQueryPropertiesTags

Name Description Value
  • Last updated on