I want all KQL query logs for application gateway

@Mayank Jain

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am afraid I do not follow when you say "all KQL query logs for application gateway".

There is two main logs, and all the other logs are derived from them.

See : How to Enable logging through the Azure portal

• Access Logs : https://video2.skills-academy.com/en-us/azure/application-gateway/application-gateway-diagnostics#access-log
• Firewall Logs : https://video2.skills-academy.com/en-us/azure/application-gateway/application-gateway-diagnostics#firewall-log

Once you have enabled them,

For AccessLogs : You can use the Below Query to list the request response.

AzureDiagnostics 
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"

For Firewall Logs:

• Use Log Analytics to examine Application Gateway Web Application Firewall (WAF) Logs

AzureDiagnostics 
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"

• This additionally also contains various scenarios such as

1. Matched/Blocked requests by IP
2. Matched/Blocked requests by URI
3. Top matched rules
4. Top five matched rule groups

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.