Azure Log Analytics tile

About Azure Log Analytics tiles

The Azure Log Analytics tile allows you to query Log Analytics data from Azure Monitor(both stand-alone and in the context of resources within Azure) and display that information as part of your SquaredUp DS dashboard.

The Azure Log Analytics tile queries Log Analytics using the query language (KQL).

The ability to render information as a graph is a feature of the Azure portal rather than the Log Analytics Query language itself. Graphs will only be shown if you have selected a suitable graph tile such as the Log Analytics Line Graph or Log Analytics Donut.

Note: If you want to show VM Insights data you need to enable VM Insights first, see How to show VM Insights data with the Azure Log Analytics tile.

How to configure an Azure Log Analytics tile

  1. Add a new tile to a dashboard and click on Integrations > Logs.
  2. Choose the visualization for your Azure Log Analytics tile:

  3. Scope:
    The scope is optional.
    If you use a scope ensure that it contains resources monitored by Azure Log Analytics.

  4. Timeframe:

    Here you determine the timeframe for the search query.

    The default timeframe uses the dynamic page timeframe.

    Take care when using a long timeframe, as this may pull many thousands of entries and significantly impact browser performance.

    If your query doesn't specify a timeframe

    Set the timeframe to use page timeframe to make the search query adapt to the dynamic page timeframe or set the timeframe to specific timeframe to choose a fixed timeframe. In this case, the search query will ignore the current page timeframe.

    If you are using the page timeframe,you can add a "clamping" timeframe in the query (such as where timestamp >= ago(7d)). When the page timeframe is less than 7 days it will be used, but once the page timeframe exceeds 7 days the query will enforce the max time.

    If your query specifies a timeframe

    If you specify a timeframe in the query (e.g. where timestamp >= ago(2h)), events must satisfy both the timeframe you set here and in the where clause in your query.

    If you want to control the timeframe using only the query, set the tile timeframe to time range > all.

  5. Workspace:
    Pick the workspace you want to query from the drop-down list. For more information see Create a Log Analytics workspace in the Azure portal.
    It is not possible to query multiple workspaces on a single tile, because the Azure API in use does not support cross-resource queries.
  6. Query:
    Test your query in the Log Analytics workspace in the Azure portal to be sure it returns the results expected. You can find many sample queries in this area of the portal.
    Copy and paste the tested query into the Azure Log Analytics tile query box.
    view in portal button:
    Opens the specified workspace in the Azure portal in a new tab. From here you can test any query to be sure it returns the results expected, then save the query to the workspace, so it is ready to be accessed from SquaredUp DS using the saved searches button.
    saved searches button:
    Will list all searches saved in the selected workspace. This is a quick and easy way to pull a query from the logs workspace into SquaredUp DS, where it can be edited if required.
  7. Configure the settings for your visualization:
  8. Click done to save the tile.

    The tile now shows data according to your settings.

Walkthrough

How to show VM Insights data with the Azure Log Analytics tile

VM Insights allows you to collect additional metrics called guest level metrics from your virtual machines (VMs).

You need to enable VM Insights in your Azure portal for each VM you want to monitor before you can show VM Insights data with the Azure Log Analytics tile.

You can find all information about enabling VM Insights in the Azure documentation.

Where to find KQL queries for showing VM Insights data

You can find useful queries by viewing VM Insights in your Azure portal. You'll see the underlying queries of Performance graphs when you edit them in Azure and can copy them from there. The Dependency Map shown in the Azure portal cannot currently be shown in SquaredUp DS.

Troubleshooting

"The API returned a 400 response" with message "Failed to resolve entity 'xxxxx'

Typically this indicates that a solution is missing from the queried workspace, resulting in it not containing the requested table (such as Update or UpdateSummary missing from workspaces without the Software Management solution enabled).

Was this article helpful?


Have more questions or facing an issue?