Query - Execute

Execute an Analytics query
Executes an Analytics query for data. Here is an example for using POST with an Analytics query.

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query

URI Parameters

Name In Required Type Description
workspaceId
path True

string

ID of the workspace. This is Workspace ID from the Properties blade in the Azure portal.

Request Header

Name Required Type Description
Prefer

string

Optional. The prefer header to set server timeout, query statistics and visualization information.

Request Body

Name Required Type Description
query True

string

The query to execute.

timespan

string

Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.

workspaces

string[]

A list of workspaces that are included in the query.

Responses

Name Type Description
200 OK

queryResults

OK. The API call succeeded and the Analytics query result is in the response payload

Other Status Codes

errorResponse

An error response object.

Security

oauth2

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

cross-workspace
simple-query

cross-workspace

Sample request

POST https://api.loganalytics.io/v1/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query

{
  "query": "union * | where TimeGenerated > ago(1h) | summarize count() by Type, TenantId",
  "workspaces": [
    "draft-test",
    "draft-test-2"
  ]
}

Sample response

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "count_",
          "type": "long"
        }
      ],
      "rows": [
        [
          "Usage",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "Usage",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "BillingFact",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "BillingFact",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "Operation",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "7"
        ],
        [
          "Operation",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "5"
        ]
      ]
    }
  ]
}

simple-query

Sample request

POST https://api.loganalytics.io/v1/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query

{
  "query": "Usage | take 10",
  "timespan": "PT12H"
}

Sample response

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "Computer",
          "type": "string"
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "SourceSystem",
          "type": "string"
        },
        {
          "name": "StartTime",
          "type": "datetime"
        },
        {
          "name": "EndTime",
          "type": "datetime"
        },
        {
          "name": "ResourceUri",
          "type": "string"
        },
        {
          "name": "LinkedResourceUri",
          "type": "string"
        },
        {
          "name": "DataType",
          "type": "string"
        },
        {
          "name": "Solution",
          "type": "string"
        },
        {
          "name": "BatchesWithinSla",
          "type": "long"
        },
        {
          "name": "BatchesOutsideSla",
          "type": "long"
        },
        {
          "name": "BatchesCapped",
          "type": "long"
        },
        {
          "name": "TotalBatches",
          "type": "long"
        },
        {
          "name": "AvgLatencyInSeconds",
          "type": "real"
        },
        {
          "name": "Quantity",
          "type": "real"
        },
        {
          "name": "QuantityUnit",
          "type": "string"
        },
        {
          "name": "IsBillable",
          "type": "bool"
        },
        {
          "name": "MeterId",
          "type": "string"
        },
        {
          "name": "LinkedMeterId",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        }
      ],
      "rows": [
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "ContosoSQLSrv1",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.286",
          "0.076408",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ],
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "Store010Web3",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.7",
          "0.106767",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ]
      ]
    }
  ]
}

Definitions

Name Description
column

A table column.

errorDetail

Error details.

errorInfo

The code and message for an error.

errorResponse

Error details.

logsColumnType

The data type of this column.

queryBody

The Analytics query. Learn more about the Analytics query syntax

queryResults

A query response.

Render

Visualization data in JSON format.

Statistics

Statistics represented in JSON format.

table

A query response table.

column

A table column.

Name Type Description
name

string

The name of this column.

type

logsColumnType

The data type of this column.

errorDetail

Error details.

Name Type Description
additionalProperties

object

Additional properties that can be provided on the error details object

code

string

The error's code.

message

string

A human readable error message.

resources

string[]

Indicates resources which were responsible for the error.

target

string

Indicates which property in the request is responsible for the error.

value

string

Indicates which value in 'target' is responsible for the error.

errorInfo

The code and message for an error.

Name Type Description
additionalProperties

object

Additional properties that can be provided on the error info object

code

string

A machine readable error code.

details

errorDetail[]

error details.

innererror

errorInfo

The code and message for an error.
Inner error details if they exist.

message

string

A human readable error message.

errorResponse

Error details.

Name Type Description
error

errorInfo

The code and message for an error.
The error details.

logsColumnType

The data type of this column.

Name Type Description
bool

string

datetime

string

decimal

string

dynamic

string

guid

string

int

string

long

string

real

string

string

string

timespan

string

queryBody

The Analytics query. Learn more about the Analytics query syntax

Name Type Description
query

string

The query to execute.

timespan

string

Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.

workspaces

string[]

A list of workspaces that are included in the query.

queryResults

A query response.

Name Type Description
error

errorInfo

The code and message for an error.

render

Render

Visualization data in JSON format.

statistics

Statistics

Statistics represented in JSON format.

tables

table[]

The list of tables, columns and rows.

Render

Visualization data in JSON format.

Statistics

Statistics represented in JSON format.

table

A query response table.

Name Type Description
columns

column[]

The list of columns in this table.

name

string

The name of the table.

rows

object[]

The resulting rows from this query.