az monitor log-analytics

Note

This command group has commands that are defined in two or more extensions. Each extension will automatically install the first time you run an extension command. Learn more about extensions.

Manage Azure log analytics.

Commands

Name	Description	Type	Status
az monitor log-analytics query	Query a Log Analytics workspace.	Extension	GA
az monitor log-analytics solution	Commands to manage monitor log-analytics solution.	Extension	GA
az monitor log-analytics solution create	Create the Solution.	Extension	GA
az monitor log-analytics solution delete	Delete the solution in the subscription.	Extension	GA
az monitor log-analytics solution list	List the solution list. It will retrieve both first party and third party solutions.	Extension	GA
az monitor log-analytics solution show	Get the user solution.	Extension	GA
az monitor log-analytics solution update	Update a Solution. Only updating tags supported.	Extension	GA
az monitor log-analytics solution wait	Place the CLI in a waiting state until a condition is met.	Extension	GA

az monitor log-analytics query

Query a Log Analytics workspace.

az monitor log-analytics query --analytics-query
                               --workspace
                               [--timespan]
                               [--workspaces]

Examples

Execute a simple query over past 3.5 days.

az monitor log-analytics query -w workspace-customId --analytics-query "AzureActivity | summarize count() by bin(TimeGenerated, 1h)" -t P3DT12H

Execute a saved query in workspace

az monitor log-analytics query -w workspace-customId --analytics-query $(az monitor log-analytics workspace saved-search show -g resource-group --workspace-name workspace-name -n query-name --query query --output tsv)

Required Parameters

--analytics-query

Query to execute over Log Analytics data.

--workspace -w

GUID of the Log Analytics Workspace.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--timespan -t

Timespan over which to query. Defaults to querying all available data.

--workspaces

Additional workspaces to union data for querying. Specify additional workspace IDs separated by space. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

Feedback

Was this page helpful?