入門 Resource Graph 查詢範例

發行項
06/05/2024

重要

本文的查詢範例和內容不再更新或支援。入口網站的 Azure Resource Graph 總管包含支援的類別和數據表，而 [開始使用] 索引標籤包含您可以在 ARG 總管中開啟和執行的範例查詢和進階查詢。

透過 Azure Resource Graph 了解查詢的第一個步驟是對查詢語言進行基本的認識。如果您還不熟悉 Kusto 查詢語言 (KQL)，建議參閱 KQL 教學課程，了解如何針對您要尋找的資源撰寫要求。

本文使用下列入門查詢：

計算的 Azure 資源計數
計算金鑰保存庫資源
列出依名稱排序的資源
依名稱遞減順序顯示所有虛擬機器
依名稱顯示前五個虛擬機器及其作業系統類型
依作業系統類型計算的虛擬機器計數
顯示包含儲存體的資源
列出所有虛擬網路子網路
列出所有公用 IP 位址
計算具有按訂用帳戶設定之 IP 位址的資源計數
列出具有特定標籤值的資源
列出具有特定標籤值的所有儲存體帳戶
列出所有標籤及其值
顯示沒有關聯的網路安全性群組
列出依嚴重性排序的 Azure 監視器警示
列出依嚴重性和警示狀態排序的 Azure 監視器警示
列出依嚴重性、監視服務和目標資源類型排序的 Azure 監視器警示

如尚未擁有 Azure 訂用帳戶，請在開始之前先建立免費帳戶。

語言支援

Azure CLI (透過擴充功能) 與 Azure PowerShell (透過模組) 支援 Azure Resource Graph。在執行下列任何查詢之前，請檢查您的環境已準備就緒。請參閱 Azure CLI 與 Azure PowerShell，以了解安裝及驗證所選殼層環境的步驟。

計算 Azure 資源

此查詢會傳回您具有存取權之訂用帳戶中存在的 Azure 資源的數目。這也是很好的查詢，可驗證您選擇的殼層是否已安裝適當的 Azure Resource Graph 元件，並處於正常運作狀態。

Resources
| summarize count()

根據預設，Azure CLI 會查詢所有可存取的訂用帳戶，但您可以指定 --subscriptions 參數以查詢特定訂用帳戶。

az graph query -q "Resources | summarize count()"

此範例對訂用帳戶識別碼使用變數。

subid=$(az account show --query id --output tsv)
az graph query -q "Resources | summarize count()" --subscriptions $subid

您也可以依管理群組和租用戶的範圍進行查詢。請將 <managementGroupId> 和 <tenantId> 取代為您的值。

az graph query -q "Resources | summarize count()" --management-groups '<managementGroupId>'

az graph query -q "Resources | summarize count()" --management-groups '<tenantId>'

您也可以對租用戶識別碼使用變數。

tenantid=$(az account show --query tenantId --output tsv)
az graph query -q "Resources | summarize count()" --management-groups $tenantid

根據預設，Azure PowerShell 會取得您的租用戶中所有訂用帳戶的結果。

Search-AzGraph -Query "Resources | summarize count()"

此範例會使用變數來查詢特定的訂用帳戶識別碼。

$subid = (Get-AzContext).Subscription.Id
Search-AzGraph -Query "authorizationresources | summarize count()" -Subscription $subid

您可以依管理群組和租用戶的範圍進行查詢。請將 <managementGroupId> 取代為您的值。 UseTenantScope 參數不需要值。

Search-AzGraph -Query "Resources | summarize count()" -ManagementGroup '<managementGroupId>'

Search-AzGraph -Query "Resources | summarize count()" -UseTenantScope

計算金鑰保存庫資源

此查詢會使用 count 而不是 summarize 來計算所傳回的記錄數目。只有金鑰保存庫會包含在計數中。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| count

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

Search-AzGraph -Query "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

列出依名稱排序的資源

此查詢會傳回任何類型的資源，但僅限於 name、type 和 location 屬性。它會使用 order by，以遞增 (asc) 順序依 name 屬性將屬性排序。

Resources
| project name, type, location
| order by name asc

az graph query -q "Resources | project name, type, location | order by name asc"

Search-AzGraph -Query "Resources | project name, type, location | order by name asc"

依名稱遞減順序顯示所有虛擬機器

若只要列出虛擬機器 (類型為 Microsoft.Compute/virtualMachines)，我們可以在結果中比對 type 屬性。與上述查詢類似，desc 會將 order by 變更為遞減。類型比對中的 =~ 會告知 Resource Graph 不區分大小寫。

Resources
| project name, location, type
| where type =~ 'Microsoft.Compute/virtualMachines'
| order by name desc

az graph query -q "Resources | project name, location, type| where type =~ 'Microsoft.Compute/virtualMachines' | order by name desc"

Search-AzGraph -Query "Resources | project name, location, type| where type =~ 'Microsoft.Compute/virtualMachines' | order by name desc"

依名稱顯示前五個虛擬機器及其作業系統類型

此查詢使用 top，僅擷取按名稱排序的五個相符記錄。 Azure 資源類型為 Microsoft.Compute/virtualMachines。 project 會告訴 Azure Resource Graph 要包含哪些屬性。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| project name, properties.storageProfile.osDisk.osType
| top 5 by name desc

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc"

依作業系統類型計算的虛擬機器計數

在上一個查詢的基礎上，我們仍會依 Microsoft.Compute/virtualMachines 類型的 Azure 資源限制，但不再限制傳回的記錄數目。相反地，我們使用 summarize 和 count() 來定義如何依屬性分組和彙總值，在此範例中為 properties.storageProfile.osDisk.osType。如需此字串在完整物件中顯示方式的範例，請參閱探索資源 - 虛擬機器探索。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| summarize count() by tostring(properties.storageProfile.osDisk.osType)

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"

另一種寫入相同查詢的方式是 extend 一個屬性，並提供一個臨時名稱以供查詢使用 (在此範例中為 OS)。summarize 和 count() 便會使用 OS，如前例所示。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| extend os = properties.storageProfile.osDisk.osType
| summarize count() by tostring(os)

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | extend os = properties.storageProfile.osDisk.osType | summarize count() by tostring(os)"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | extend os = properties.storageProfile.osDisk.osType | summarize count() by tostring(os)"

注意

請注意，雖然 =~ 允許不區分大小寫的比對，但在查詢中使用屬性 (例如 properties.storageProfile.osDisk.osType) 要求大小寫正確無誤。如果屬性的大小寫錯誤，傳回的值會是 Null 或不正確，且群組或摘要會不正確。

顯示包含儲存體的資源

此範例查詢並非明確定義要比對的類型，而是尋找任何containsstorage 一字的 Azure 資源。

Resources
| where type contains 'storage' | distinct type

az graph query -q "Resources | where type contains 'storage' | distinct type"

Search-AzGraph -Query "Resources | where type contains 'storage' | distinct type"

列出所有 Azure 虛擬網路子網路

此查詢會傳回 Azure 虛擬網路 (Vnet) 清單，包括子網路名稱和位址首碼。

Resources
| where type == 'microsoft.network/virtualnetworks'
| extend subnets = properties.subnets
| mv-expand subnets
| project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId

az graph query -q "Resources | where type == 'microsoft.network/virtualnetworks' | extend subnets = properties.subnets | mv-expand subnets | project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId"

Search-AzGraph -Query "Resources | where type == 'microsoft.network/virtualnetworks' | extend subnets = properties.subnets | mv-expand subnets | project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId

列出所有公用 IP 位址

與上述查詢類似，尋找類型具有字組 publicIPAddresses 的所有項目。此查詢將該模式擴展為僅包含 properties.ipAddressisnotempty 的結果、只傳回 properties.ipAddress，以及將結果 limit 在前 100 個。您可能需要逸出的引號，根據您所選擇的殼層而定。

Resources
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
| project properties.ipAddress
| limit 100

az graph query -q "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | project properties.ipAddress | limit 100"

Search-AzGraph -Query "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | project properties.ipAddress | limit 100"

計算具有按訂用帳戶設定之 IP 位址的資源計數

使用上一個範例查詢，並新增 summarize 和 count()，我們可以取得具有已設定 IP 位址之資源的訂用帳戶清單。

Resources
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
| summarize count () by subscriptionId

az graph query -q "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId"

Search-AzGraph -Query "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId"

列出具有特定標籤值的資源

我們可以根據 Azure 資源類型以外的屬性限制結果，例如標籤。在此範例中，我們會篩選標籤名稱為 Environment 的 Azure 資源進行篩選，其值為 Internal。

Resources
| where tags.environment=~'internal'
| project name

az graph query -q "Resources | where tags.environment=~'internal' | project name"

Search-AzGraph -Query "Resources | where tags.environment=~'internal' | project name"

若也要提供資源具有哪些標籤和其值，請將 tags 屬性新增至 project 關鍵字。

Resources
| where tags.environment=~'internal'
| project name, tags

az graph query -q "Resources | where tags.environment=~'internal' | project name, tags"

Search-AzGraph -Query "Resources | where tags.environment=~'internal' | project name, tags"

列出具有特定標籤值的所有儲存體帳戶

結合前一個範例的篩選功能，依 type 屬性篩選 Azure 資源類型。此查詢也會將搜尋限制為具有特定標籤名稱和值的特定類型 Azure 資源。

Resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where tags['tag with a space']=='Custom value'

az graph query -q "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where tags['tag with a space']=='Custom value'"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where tags['tag with a space']=='Custom value'"

注意

此範例會使用 == 進行比對，而非使用 =~ 條件。 == 是區分大小寫的比對。

列出所有標籤及其值

此查詢會列出管理群組、訂用帳戶和資源上的標籤及其值。首先，查詢會限制標籤為 isnotempty() 的資源，只在 project、mvexpand、extend 中包含 tags 來限制內含的欄位，然後從屬性包取得配對資料。接著使用 union，合併來自 ResourceContainers 的結果與來自 Resources 的相同結果，提供可擷取標籤的廣泛範圍。最後，查詢會將結果限制為 distinct 配對資料，並排除系統隱藏的標籤。

ResourceContainers
| where isnotempty(tags)
| project tags
| mvexpand tags
| extend tagKey = tostring(bag_keys(tags)[0])
| extend tagValue = tostring(tags[tagKey])
| union (
    resources
    | where isnotempty(tags)
    | project tags
    | mvexpand tags
    | extend tagKey = tostring(bag_keys(tags)[0])
    | extend tagValue = tostring(tags[tagKey])
)
| distinct tagKey, tagValue
| where tagKey !startswith "hidden-"

az graph query -q "ResourceContainers | where isnotempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) | union (resources | where notempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) ) | distinct tagKey, tagValue | where tagKey !startswith "hidden-""

Search-AzGraph -Query "ResourceContainers | where isnotempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) | union (resources | where notempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) ) | distinct tagKey, tagValue | where tagKey !startswith "hidden-""

顯示沒有關聯的網路安全性群組

此查詢會傳回並未與網路介面或子網相關聯的網路安全性群組 (NSG)。

Resources
| where type =~ "microsoft.network/networksecuritygroups" and isnull(properties.networkInterfaces) and isnull(properties.subnets)
| project name, resourceGroup
| sort by name asc

az graph query -q "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc"

Search-AzGraph -Query "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc"

列出依嚴重性排序的 Azure 監視器警示

此查詢會使用 alertsmanagementresources 資料表傳回依嚴重性排序的 Azure 監視器警示。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity)
| summarize AlertsCount = count() by Severity

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity) | summarize AlertsCount = count() by Severity"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity) | summarize AlertsCount = count() by Severity"

列出依嚴重性和警示狀態排序的 Azure 監視器警示

此查詢會使用 alertsmanagementresources 資料表傳回依嚴重性和警示狀態排序的 Azure 監視器警示。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState)
| summarize AlertsCount = count() by Severity, AlertState

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState) | summarize AlertsCount = count() by Severity, AlertState"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState) | summarize AlertsCount = count() by Severity, AlertState"

列出依嚴重性、監視服務和目標資源類型排序的 Azure 監視器警示

此查詢會使用 alertsmanagementresources 資料表傳回依嚴重性、監視服務和目標資源類型排序的 Azure 監視器警示。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity),
MonitorCondition = tostring(properties.essentials.monitorCondition),
ObjectState = tostring(properties.essentials.alertState),
MonitorService = tostring(properties.essentials.monitorService),
AlertRuleId = tostring(properties.essentials.alertRule),
SignalType = tostring(properties.essentials.signalType),
TargetResource = tostring(properties.essentials.targetResourceName),
TargetResourceType = tostring(properties.essentials.targetResourceName), id
| summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), MonitorCondition = tostring(properties.essentials.monitorCondition), ObjectState = tostring(properties.essentials.alertState), MonitorService = tostring(properties.essentials.monitorService), AlertRuleId = tostring(properties.essentials.alertRule), SignalType = tostring(properties.essentials.signalType), TargetResource = tostring(properties.essentials.targetResourceName), TargetResourceType = tostring(properties.essentials.targetResourceName), id | summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), MonitorCondition = tostring(properties.essentials.monitorCondition), ObjectState = tostring(properties.essentials.alertState), MonitorService = tostring(properties.essentials.monitorService), AlertRuleId = tostring(properties.essentials.alertRule), SignalType = tostring(properties.essentials.signalType), TargetResource = tostring(properties.essentials.targetResourceName), TargetResourceType = tostring(properties.essentials.targetResourceName), id | summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType"

下一步

深入了解查詢語言。
深入了解如何探索資源。
請參閱進階查詢的範例。

共用方式為