Metadata - Post

Service:

Log Analytics

API Version:

v1

Gets metadata information
Retrieve the metadata information for the workspace, including its schema, functions, workspace info, categories etc.

POST {endpoint}/{apiVersion}/workspaces/{workspaceId}/metadata

URI Parameters

Name	In	Required	Type	Description
apiVersion	path	True	string	The service API version.
endpoint	path	True	string (uri)	The Log Analytics service endpoint.
workspaceId	path	True	string	Primary Workspace ID of the query. This is the Workspace ID from the Properties blade in the Azure portal.

Responses

Name	Type	Description
200 OK	MetadataResults	The request has succeeded.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

OAuth2Auth

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
https://api.loganalytics.io/.default

Examples

Metadata POST request

Sample request

HTTP

POST {endpoint}/2018-04-20/workspaces/b438b4f6-912a-46d5-9cb1-b44069212abc/metadata

Sample response

Status code:

200

{
  "categories": [
    {
      "displayName": "Workloads",
      "id": "workloads",
      "related": {
        "tables": [
          "ADAssessmentRecommendation",
          "ADReplicationResult",
          "SQLAssessmentRecommendation",
          "WorkloadMonitoringPerf"
        ]
      }
    }
  ],
  "functions": [
    {
      "name": "dwad",
      "body": "Heartbeat\r\n| where ResourceGroup != \"rg-SAP-DEVQA-005\" and ResourceGroup != \"rg-SAP-DEVQA-006\" and Computer contains \"\"\r\n| limit 500000\r\n| sort by Computer asc\r\n| distinct Computer\r\n",
      "displayName": "dasd",
      "id": "dwad",
      "related": {
        "solutions": [
          "ADAssessment"
        ],
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "resourceTypes": [
    {
      "type": "Microsoft.Compute/VirtualMachines",
      "displayName": "Virtual machines",
      "id": "microsoft.compute/virtualmachines",
      "related": {
        "tables": [
          "ADAssessmentRecommendation"
        ]
      }
    }
  ],
  "solutions": [
    {
      "name": "ADAssessment",
      "description": "Assess the risk and health of Active Directory environments.",
      "displayName": "Active Directory Health Check",
      "id": "ADAssessment",
      "related": {
        "functions": [
          "dwad"
        ],
        "tables": [
          "ADAssessmentRecommendation"
        ],
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "tables": [
    {
      "name": "ADAssessmentRecommendation",
      "description": "Recommendations generated by AD assessments that are started through a scheduled task. When you schedule the assessment it runs by default every 7 days and upload the data into Azure Log Analytics",
      "columns": [
        {
          "name": "SourceSystem",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AssessmentId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Recommendation",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Description",
          "type": "string"
        },
        {
          "name": "RecommendationResult",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "FocusAreaId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "FocusArea",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ActionAreaId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ActionArea",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationWeight",
          "type": "real"
        },
        {
          "name": "Computer",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AffectedObjectType",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AffectedObjectName",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Forest",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Domain",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "DomainController",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Technology",
          "type": "string"
        },
        {
          "name": "CustomData",
          "type": "string"
        },
        {
          "name": "TargetCount",
          "type": "int"
        },
        {
          "name": "IsRollup",
          "type": "bool",
          "isPreferredFacet": true
        },
        {
          "name": "IsCopied",
          "type": "bool",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationPeriod",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "_ResourceId",
          "type": "string"
        }
      ],
      "id": "ADAssessmentRecommendation",
      "related": {
        "categories": [
          "workloads"
        ],
        "resourceTypes": [
          "microsoft.compute/virtualmachines"
        ],
        "solutions": [
          "ADAssessment"
        ]
      },
      "timespanColumn": "TimeGenerated"
    },
    {
      "name": "custom_CL",
      "columns": [
        {
          "name": "SourceSystem",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ManagementGroupName",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "TimeGenerated",
          "type": "datetime",
          "isPreferredFacet": true
        },
        {
          "name": "Computer",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RawData",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "_ResourceId",
          "type": "string"
        }
      ],
      "id": "custom_CL",
      "related": {
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      },
      "timespanColumn": "TimeGenerated"
    }
  ],
  "workspaces": [
    {
      "name": "contosoretail-IT",
      "id": "b438b4f6-912a-46d5-9cb1-b44069212abc",
      "region": "eastus",
      "related": {
        "functions": [
          "dwad"
        ],
        "resourceTypes": [
          "microsoft.compute/virtualmachines"
        ],
        "solutions": [
          "ADAssessment"
        ],
        "tables": [
          "custom_CL"
        ]
      },
      "resourceId": "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourceGroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-IT"
    }
  ]
}

Definitions

Name	Description
ColumnDataType	The data type of a column.
ErrorDetail	Error details.
ErrorInfo	The code and message for an error.
ErrorResponse	Contains details when the response code indicates an error.
MetadataApplication	Application Insights apps that were part of the metadata request and that the user has access to.
MetadataApplicationRelated	The related metadata items for the Application Insights app.
MetadataCategory	Categories are used to group other metadata entities.
MetadataCategoryRelated	The related metadata items for the category
MetadataFunction	Functions are stored Kusto queries that can be specified as part of queries by using their name.
MetadataFunctionRelated	The related metadata items for the function.
MetadataPermissions	Permission information for the metadata call, includes apps/workspaces/resource the user didn't have access to.
MetadataPermissionsApplicationsItem	The permission indication for the Application Insights apps on the metadata request.
MetadataPermissionsResourcesItem	The permission indication for the Azure resources on the metadata request.
MetadataPermissionsWorkspacesItem	The permission indication for the workspaces on the metadata request.
MetadataQuery	Queries are stored pieces of KQL, along with a list of relevant metadata items.
MetadataQueryRelated	The related metadata items for the query.
MetadataResourceType	Metadata about types of Azure resources, containing relevant tables, functions, etc.
MetadataResourceTypeRelated	The related metadata items for the resource-type
MetadataResults	The metadata response for the app, including available tables, etc.
MetadataSolution	Solutions can group tables and functions that are associated with a certain Azure Log Analytics offering.
MetadataSolutionRelated	The related metadata items for the Log Analytics solution
MetadataTable	Tables are part of the workspace schema, and contain a list of columns and a reference to other relevant metadata items.
MetadataTableColumnsItem	A column in a metadata table.
MetadataTableRelated	The related metadata items for the table
MetadataWorkspace	Log Analytics workspaces that were part of the metadata request and that the user has access to.
MetadataWorkspaceRelated	The related metadata items for the Log Analytics workspace.

ColumnDataType

Enumeration

The data type of a column.

Value	Description
bool	Boolean data type
datetime	DateTime data type
dynamic	Dynamic data type
int	Integer data type
long	Long integer data type
real	Real/floating point data type
string	String data type
guid	GUID data type
decimal	Decimal data type
timespan	Timespan data type

ErrorDetail

Object

Error details.

Name	Type	Description
additionalProperties		Additional properties that can be provided on the error details object
code	string	The error's code.
message	string	A human readable error message.
resources	string[]	Indicates resources which were responsible for the error.
target	string	Indicates which property in the request is responsible for the error.
value	string	Indicates which value in 'target' is responsible for the error.

ErrorInfo

Object

The code and message for an error.

Name	Type	Description
additionalProperties		Additional properties that can be provided on the error info object
code	string	A machine readable error code.
details	ErrorDetail[]	error details.
innererror	ErrorInfo	Inner error details if they exist.
message	string	A human readable error message.

ErrorResponse

Object

Contains details when the response code indicates an error.

Name	Type	Description
error	ErrorInfo	The error details.

MetadataApplication

Object

Application Insights apps that were part of the metadata request and that the user has access to.

Name	Type	Description
id	string	The ID of the Application Insights app.
name	string	The name of the Application Insights app.
region	string	The Azure region of the Application Insights app.
related	MetadataApplicationRelated	The related metadata items for the Application Insights app.
resourceId	string	The ARM resource ID of the Application Insights app.

MetadataApplicationRelated

Object

The related metadata items for the Application Insights app.

Name	Type	Description
functions	string[]	The related functions for the Application Insights app.
tables	string[]	The related tables for the Application Insights app.

MetadataCategory

Object

Categories are used to group other metadata entities.

Name	Type	Description
description	string	The description of the category
displayName	string	The display name of the category
id	string	The ID of the category
related	MetadataCategoryRelated	The related metadata items for the category

MetadataCategoryRelated

Object

The related metadata items for the category

Name	Type	Description
functions	string[]	The functions related to the category
queries	string[]	The saved queries related to the category
resourceTypes	string[]	The resource types related to the category
solutions	string[]	The Log Analytics solutions related to the category
tables	string[]	The tables related to the category

MetadataFunction

Object

Functions are stored Kusto queries that can be specified as part of queries by using their name.

Name	Type	Description
body	string	The KQL body of the function.
description	string	The description of the function.
displayName	string	The display name of the function.
id	string	The ID of the function.
name	string	The name of the function, to be used in queries.
parameters	string	The parameters/arguments of the function, if any.
properties		The properties of the function.
related	MetadataFunctionRelated	The related metadata items for the function.
tags	object	The tags associated with the function.

MetadataFunctionRelated

Object

The related metadata items for the function.

Name	Type	Description
categories	string[]	The related categories for the function.
resourceTypes	string[]	The related resource types for the function.
solutions	string[]	The related Log Analytics solutions for the function.
tables	string[]	The related tables for the function.
workspaces	string[]	The related workspaces for the function.

MetadataPermissions

Object

Permission information for the metadata call, includes apps/workspaces/resource the user didn't have access to.

Name	Type	Description
applications	MetadataPermissionsApplicationsItem[]	The permission indication for the Application Insights apps on the metadata request.
resources	MetadataPermissionsResourcesItem[]	The permission indication for the Azure resources on the metadata request.
workspaces	MetadataPermissionsWorkspacesItem[]	The permission indication for the workspaces on the metadata request.

MetadataPermissionsApplicationsItem

Object

The permission indication for the Application Insights apps on the metadata request.

Name	Type	Description
resourceId	string	The resource ID on the permission indication.

MetadataPermissionsResourcesItem

Object

The permission indication for the Azure resources on the metadata request.

Name	Type	Description
denyTables	string[]	The list of tables that were denied access for the resource ID.
resourceId	string	The resource ID on the permission indication.

MetadataPermissionsWorkspacesItem

Object

The permission indication for the workspaces on the metadata request.

Name	Type	Description
denyTables	string[]	The list of tables that were denied access for the resource ID.
resourceId	string	The resource ID on the permission indication.

MetadataQuery

Object

Queries are stored pieces of KQL, along with a list of relevant metadata items.

Name	Type	Description
body	string	The KQL body of the query.
description	string	The description of the query.
displayName	string	The display name of the query.
id	string	The ID of the query.
labels	string[]	The user defined labels associated with the query.
properties		The properties of the query.
related	MetadataQueryRelated	The related metadata items for the query.
tags	object	The tags associated with the query.

MetadataQueryRelated

Object

The related metadata items for the query.

Name	Type	Description
categories	string[]	The related categories for the query.
resourceTypes	string[]	The related resource types for the query.
solutions	string[]	The related Log Analytics solutions for the query.
tables	string[]	The related tables for the query.

MetadataResourceType

Object

Metadata about types of Azure resources, containing relevant tables, functions, etc.

Name	Type	Description
description	string	The description of the resource-type
displayName	string	The display name of the resource-type
id	string	The ID of the resource-type
labels	string[]	The user-defined labels of the resource-type
properties		The properties of the resource-type
related	MetadataResourceTypeRelated	The related metadata items for the resource-type
tags	object	The tags associated with the resource-type
type	string	The type of the resource-type

MetadataResourceTypeRelated

Object

The related metadata items for the resource-type

Name	Type	Description
categories	string[]	The categories related to the resource-type
functions	string[]	The functions related to the resource-type
queries	string[]	The queries related to the resource-type
resources	string[]	The Azure resources related to the resource-type
tables	string[]	The tables related to the resource-type
workspaces	string[]	The Log Analytics workspaces related to the resource-type

MetadataResults

Object

The metadata response for the app, including available tables, etc.

Name	Type	Description
applications	MetadataApplication[]	The list of Application Insights apps that were referenced in the metadata request.
categories	MetadataCategory[]	The list of categories that are referenced in this metadata response.
functions	MetadataFunction[]	The list of functions stored on the workspace, or introduced by solutions etc.
permissions	MetadataPermissions[]	The list of permission rules that affected the metadata request.
queries	MetadataQuery[]	The list of saved queries stored on the workspace, or introduced by solutions, resource types, etc.
resourceTypes	MetadataResourceType[]	The list of resource types that are referenced in this metadata response.
resources	string[]	The list of Azure resources that were referenced in the metadata request.
solutions	MetadataSolution[]	The list of Log Analytics solutions installed on the workspace.
tables	MetadataTable[]	The list of tables and columns that comprise the schema of the workspace.
workspaces	MetadataWorkspace[]	The list of Log Analytics workspaces that were referenced in the metadata request.

MetadataSolution

Object

Solutions can group tables and functions that are associated with a certain Azure Log Analytics offering.

Name	Type	Description
description	string	The description of the Log Analytics solution
displayName	string	The display name of the Log Analytics solution
id	string	The ID of the Log Analytics solution
name	string	The name of the Log Analytics solution
properties		The properties of the Log Analytics solution
related	MetadataSolutionRelated	The related metadata items for the Log Analytics solution
tags	object	The tags that are associated with the Log Analytics solution

MetadataSolutionRelated

Object

The related metadata items for the Log Analytics solution

Name	Type	Description
categories	string[]	The categories related to the Log Analytics solution
functions	string[]	The functions related to the Log Analytics solution
queries	string[]	The saved queries related to the Log Analytics solution
tables	string[]	The tables related to the Log Analytics solution
workspaces	string[]	The Workspaces referenced in the metadata request that are related to the Log Analytics solution

MetadataTable

Object

Tables are part of the workspace schema, and contain a list of columns and a reference to other relevant metadata items.

Name	Type	Description
columns	MetadataTableColumnsItem[]	The list of columns defined on the table
description	string	The description of the table
id	string	The ID of the table
labels	string[]	The user defined labels of the table
name	string	The name of the table
properties		The properties of the table
related	MetadataTableRelated	The related metadata items for the table
tags	object	The tags associated with the table
timespanColumn	string	The column associated with the timespan query parameter for the table

MetadataTableColumnsItem

Object

A column in a metadata table.

Name	Type	Description
description	string	The description of the column
isPreferredFacet	boolean	A flag indicating this column is a preferred facet
name	string	The name of the column
source		An indication of the source of the column, used only when multiple workspaces have conflicting definition for the column
type	ColumnDataType	The data type of the column

MetadataTableRelated

Object

The related metadata items for the table

Name	Type	Description
categories	string[]	The related categories for the table
functions	string[]	The related functions for the table
queries	string[]	The related saved queries for the table
resourceTypes	string[]	The related resource types for the table
solutions	string[]	The related Log Analytics solutions for the table
workspaces	string[]	The related Log Analytics workspaces for the table

MetadataWorkspace

Object

Log Analytics workspaces that were part of the metadata request and that the user has access to.

Name	Type	Description
id	string	The ID of the Log Analytics workspace.
name	string	The name of the Log Analytics workspace.
region	string	The Azure region of the Log Analytics workspace.
related	MetadataWorkspaceRelated	The related metadata items for the Log Analytics workspace.
resourceId	string	The ARM resource ID of the Log Analytics workspace.

MetadataWorkspaceRelated

Object

The related metadata items for the Log Analytics workspace.

Name	Type	Description
functions	string[]	The related functions for the Log Analytics workspace.
resourceTypes	string[]	The related resource types for the Log Analytics workspace.
resources	string[]	The related Azure resources for the Log Analytics workspace.
solutions	string[]	The related Log Analytics solutions for the Log Analytics workspace.
tables	string[]	The related tables for the Log Analytics workspace.