Azure Monitor REST API Filter Syntax

  • Article
  • 2 minutes to read

Many Azure Monitor APIs take a parameter, {filter-expression}, that you can use to filter or constrain the set of data that is collected.

Here are the possible expression strings you can pass as {filter-expression}. No other syntax is allowed.

  • List events for a resource group

    $filter=eventTimestamp ge <Start Time> and eventTimestamp le <End Time> and eventChannels eq 'Admin, Operation' and resourceGroupName eq '<ResourceGroupName>'

    Example:

    $filter=eventTimestamp ge 2014-12-29T22:00:37Z and eventTimestamp le 2014-12-29T23:36:37Z and eventChannels eq 'Admin, Operation' and resourceGroupName eq 'CloudLab'

  • List events for a resource

    $filter=eventTimestamp ge <Start Time> and eventTimestamp le <End Time> and eventChannels eq 'Admin, Operation' and resourceUri eq '<ResourceURI>'

    Example:

    $filter=eventTimestamp ge 2014-12-29T22:00:37Z and eventTimestamp le 2014-12-29T23:36:37Z and eventChannels eq 'Admin, Operation' and resourceUri eq '/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourcegroups/CloudLab/providers/Microsoft.Web/sites/mytestweb004'

  • List events for an Azure subscription

    $filter=eventTimestamp ge <Start Time> and eventTimestamp le <End Time> and eventChannels eq 'Admin, Operation'

    Example:

    $filter=eventTimestamp ge 2014-12-29T22:00:37Z and eventTimestamp le 2014-12-29T23:36:37Z and eventChannels eq 'Admin, Operation'

  • List events for an Azure resource provider

    $filter=eventTimestamp ge <Start Time> and eventTimestamp le <End Time> and eventChannels eq 'Admin, Operation' and resourceProvider eq '<ResourceProviderName>'

    Example:

    $filter=eventTimestamp ge 2014-12-29T22:00:37Z and eventTimestamp le 2014-12-29T23:36:37Z and eventChannels eq 'Admin, Operation' and resourceProvider eq 'Microsoft.Web'

  • List events for a correlation ID

    api-version=2014-04-01&$filter=eventTimestamp ge 2014-07-16T04:36:37.6407898Z and eventTimestamp le 2014-07-20T04:36:37.6407898Z and eventChannels eq 'Admin, Operation' and correlationId eq '<CorrelationID>'

    Example: api-version=2014-04-01&$filter=eventTimestamp ge 2014-12-29T22:00:37Z and eventTimestamp le 2014-12-29T23:36:37Z and eventChannels eq 'Admin, Operation' and correlationId eq '07c85493-5e87-4efd-9200-0c64d904d878'