Query - Execute

Service:: Log Analytics

API Version:: v1

Execute an Analytics query
Executes an Analytics query for data. Here is an example for using POST with an Analytics query.

POST {endpoint}/{apiVersion}/workspaces/{workspaceId}/query

URI Parameters

Name	In	Required	Type	Description
apiVersion	path	True	string	The service API version.
endpoint	path	True	string (uri)	The Log Analytics service endpoint.
workspaceId	path	True	string	Primary Workspace ID of the query. This is the Workspace ID from the Properties blade in the Azure portal.

Request Header

Name	Required	Type	Description
Prefer		string	Optional. The prefer header to set server timeout, query statistics and visualization information.

Request Body

Name	Required	Type	Description
query	True	string	The query to execute.
timespan		string	Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.
workspaces		string[]	A list of workspaces to query in addition to the primary workspace.

Responses

Name	Type	Description
200 OK	QueryResults	The request has succeeded.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

OAuth2Auth

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
https://api.loganalytics.io/.default

Examples

A cross workspace POST query

A simple POST query on a workspace

A cross workspace POST query

Sample request

HTTP

POST {endpoint}/{apiVersion}/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query

{
  "query": "union * | where TimeGenerated > ago(1h) | summarize count() by Type, TenantId",
  "workspaces": [
    "draft-test",
    "draft-test-2"
  ]
}

Sample response

Status code:: 200

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "count_",
          "type": "long"
        }
      ],
      "rows": [
        [
          "Usage",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "Usage",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "BillingFact",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "BillingFact",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "Operation",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "7"
        ],
        [
          "Operation",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "5"
        ]
      ]
    }
  ]
}

A simple POST query on a workspace

Sample request

HTTP

POST {endpoint}/{apiVersion}/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query

{
  "query": "Usage | take 10",
  "timespan": "PT12H"
}

Sample response

Status code:: 200

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "Computer",
          "type": "string"
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "SourceSystem",
          "type": "string"
        },
        {
          "name": "StartTime",
          "type": "datetime"
        },
        {
          "name": "EndTime",
          "type": "datetime"
        },
        {
          "name": "ResourceUri",
          "type": "string"
        },
        {
          "name": "LinkedResourceUri",
          "type": "string"
        },
        {
          "name": "DataType",
          "type": "string"
        },
        {
          "name": "Solution",
          "type": "string"
        },
        {
          "name": "BatchesWithinSla",
          "type": "long"
        },
        {
          "name": "BatchesOutsideSla",
          "type": "long"
        },
        {
          "name": "BatchesCapped",
          "type": "long"
        },
        {
          "name": "TotalBatches",
          "type": "long"
        },
        {
          "name": "AvgLatencyInSeconds",
          "type": "real"
        },
        {
          "name": "Quantity",
          "type": "real"
        },
        {
          "name": "QuantityUnit",
          "type": "string"
        },
        {
          "name": "IsBillable",
          "type": "bool"
        },
        {
          "name": "MeterId",
          "type": "string"
        },
        {
          "name": "LinkedMeterId",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        }
      ],
      "rows": [
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "ContosoSQLSrv1",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.286",
          "0.076408",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ],
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "Store010Web3",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.7",
          "0.106767",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ]
      ]
    }
  ]
}

Definitions

Name	Description
Column	A column in a table.
ColumnDataType	The data type of a column.
ErrorDetail	Error details.
ErrorInfo	The code and message for an error.
ErrorResponse	Contains details when the response code indicates an error.
QueryBody	The Analytics query. Learn more about the Analytics query syntax
QueryResults	Contains the tables, columns & rows resulting from a query.
Table	Contains the columns and rows for one table in a query response.

Column

Object

A column in a table.

Name	Type	Description
name	string	The name of this column.
type	ColumnDataType	The data type of this column.

ColumnDataType

Enumeration

The data type of a column.

Value	Description
bool	Boolean data type
datetime	DateTime data type
dynamic	Dynamic data type
int	Integer data type
long	Long integer data type
real	Real/floating point data type
string	String data type
guid	GUID data type
decimal	Decimal data type
timespan	Timespan data type

ErrorDetail

Object

Error details.

Name	Type	Description
additionalProperties		Additional properties that can be provided on the error details object
code	string	The error's code.
message	string	A human readable error message.
resources	string[]	Indicates resources which were responsible for the error.
target	string	Indicates which property in the request is responsible for the error.
value	string	Indicates which value in 'target' is responsible for the error.

ErrorInfo

Object

The code and message for an error.

Name	Type	Description
additionalProperties		Additional properties that can be provided on the error info object
code	string	A machine readable error code.
details	ErrorDetail[]	error details.
innererror	ErrorInfo	Inner error details if they exist.
message	string	A human readable error message.

ErrorResponse

Object

Contains details when the response code indicates an error.

Name	Type	Description
error	ErrorInfo	The error details.

QueryBody

Object

The Analytics query. Learn more about the Analytics query syntax

Name	Type	Description
query	string	The query to execute.
timespan	string	Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.
workspaces	string[]	A list of workspaces to query in addition to the primary workspace.

QueryResults

Object

Contains the tables, columns & rows resulting from a query.

Name	Type	Description
error	ErrorInfo	The code and message for an error.
render		Visualization data in JSON format.
statistics		Statistics represented in JSON format.
tables	Table[]	The results of the query in tabular format.

Table

Object

Contains the columns and rows for one table in a query response.

Name	Type	Description
columns	Column[]	The list of columns in this table.
name	string	The name of the table.
rows	Rows[]	The resulting rows from this query.

Share via

Query - Execute

URI Parameters

Request Header

Request Body

Responses

Security

OAuth2Auth

Scopes

Examples

A cross workspace POST query

Sample request

Sample response

A simple POST query on a workspace

Sample request

Sample response

Definitions

Column

ColumnDataType

ErrorDetail

ErrorInfo

ErrorResponse

QueryBody

QueryResults

Table