ResourceCentricLogs.md

Note

This documentation for Azure workbooks is now located at: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview Please do not edit this file. All up-to-date information is in the new location and documentation should only be updated there.

Tutorial - resource centric logs queries in workbooks

This video shows you how to use resource level logs queries in Azure Workbooks. It also has tips and tricks on how to enable advanced scenarios and improve performance.

Dynamic resource type parameter

Uses dynamic scopes for more efficient querying. The snippet below uses this heuristc:

1. Individual resources: if the count of selected resource is less than or equal to 5
2. Resource groups: if the number of resources is over 5 but the number of resource groups the resources belong to is less than or equal to 3
3. Subscriptions: otherwise

Resources
| take 1
| project x = dynamic(["microsoft.compute/virtualmachines", "microsoft.compute/virtualmachinescalesets", "microsoft.resources/resourcegroups", "microsoft.resources/subscriptions"])
| mvexpand x to typeof(string)
| extend jkey = 1
| join kind = inner (Resources 
| where id in~ ({VirtualMachines})
| summarize Subs = dcount(subscriptionId), resourceGroups = dcount(resourceGroup), resourceCount = count()
| extend jkey = 1) on jkey
| project x, label = 'x', 
      selected = case(
        x in ('microsoft.compute/virtualmachinescalesets', 'microsoft.compute/virtualmachines') and resourceCount <= 5, true, 
        x == 'microsoft.resources/resourcegroups' and resourceGroups <= 3 and resourceCount > 5, true, 
        x == 'microsoft.resources/subscriptions' and resourceGroups > 3 and resourceCount > 5, true, 
        false)

Static resource scope for querying multiple resource types

[
    { "value":"microsoft.compute/virtualmachines", "label":"Virtual machine", "selected":true },
    { "value":"microsoft.compute/virtualmachinescaleset", "label":"Virtual machine scale set", "selected":true }
]

Resource parameter grouped by resource type

Resources
| where type =~ 'microsoft.compute/virtualmachines' or type =~ 'microsoft.compute/virtualmachinescalesets' 
| where resourceGroup in~({ResourceGroups}) 
| project value = id, label = id, selected = false, 
      group = iff(type =~ 'microsoft.compute/virtualmachines', 'Virtual machines', 'Virtual machine scale sets')