Log Analytics Workspaces and KQL Queries

Azure Basics · Azure Monitor – Metrics, Logs, Alerts, Log Analytics, Network Watcher · Lesson 4 of 5

A workspace is where logs are collected and stored as tables; KQL chains operators with pipes — where filters, summarize groups, bin() buckets time, ago() counts back from now.

A Log Analytics workspace is an Azure resource holding logs as tables (Heartbeat, Perf, Event, Syslog, AzureActivity…). The workspace decides geographic location (data residency), retention (30 days by default with PerGB2018) and access scope. You can have several workspaces.

Data sources: Windows/Linux VMs through the Azure Monitor Agent + Data Collection Rules (Windows Event Logs, performance counters, Syslog, IIS logs, custom logs), resource diagnostic settings and the Activity Log. The "connected source" model with MMA/SCOM is the old approach.

KQL (Kusto Query Language): start from a table name; each | passes results to the next operator.

Operator	Example	Meaning
`where`	`where TimeGenerated > ago(1d)`	Filter rows (compare with `==`)
`summarize`	`summarize count() by Computer`	Group and aggregate
`bin()`	`by bin(TimeGenerated, 1h)`	Bucket by time
`ago()`	`ago(30m)`, `ago(1d)`	A time counted back from now
`top` / `take`	`top 10 by ErrorCount desc` / `take 5`	Take N rows
`project`	`project Computer, TimeGenerated`	Pick columns

flowchart LR
  T["Event (all rows)"] --> W1["where EventLevelName == 'Error'"]
  W1 --> W2["where TimeGenerated > ago(1d)"]
  W2 --> S["summarize ErrorCount = count() by Computer"]
  S --> P["top 10 by ErrorCount desc"]

Query results feed log alerts, saved searches, dashboards/workbooks, and Power BI/Excel exports.

Traps: KQL is not SQL (no SELECT, comparison is ==); the CLI query needs the workspace GUID (customerId), not its name; log-analytics query comes from an extension (Cloud Shell offers to install it).

Command	Meaning
`az monitor log-analytics workspace create -g rg-devops-lab -n log-lab`	Create a workspace
`az monitor log-analytics workspace show -g rg-devops-lab -n log-lab --query customerId -o tsv`	Get the GUID
`az monitor log-analytics query -w "$WS_ID" --analytics-query "Heartbeat \\| summarize count() by Computer"`	Run KQL

More KQL operators

Operator	Example	Meaning
`extend`	`extend DurationSec = DurationMs / 1000`	Add a calculated column
`count`	`Syslog \\| count`	Number of rows
`distinct`	`distinct Computer`	Unique values
`has` / `contains`	`where Message has "timeout"`	`has` matches whole terms and is faster
`parse`	`parse Message with * "user=" User " " *`	Extract values from text
`join`	`join kind=inner (Heartbeat) on Computer`	Combine two tables
`render`	`render timechart`	Draw a chart

A complete query that charts average CPU per VM:

Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AvgCpu = avg(CounterValue) by Computer, bin(TimeGenerated, 15m)
| render timechart

Filter on time and narrow columns early; queries that scan everything are slow and can be throttled.

Cost and retention

Log Analytics charges mainly per GB ingested. A daily cap prevents surprise bills, though it stops collection when reached, and commitment tiers lower the per-GB price at higher volumes. Tables can use the Analytics plan for full querying or cheaper Basic and Auxiliary plans for high-volume logs you query rarely. Interactive retention can be extended, and older data kept in long-term retention for up to 12 years.

Workspace design and access

Many organisations use a small number of central workspaces per region or security boundary rather than one per application, which simplifies cross-resource queries. Resource-context access lets a team query only logs from resources they already have RBAC rights on. Microsoft Sentinel, the SIEM, runs on top of a Log Analytics workspace, so security and operations data can share it.

Save useful queries as functions or in a query pack so the team reuses the same tested KQL.