Query - Execute

Reference

Service:: Log Analytics

API Version:: 2022-10-27_Preview

Execute an Analytics query
Executes an Analytics query for data. Here is an example for using POST with an Analytics query.

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query

URI Parameters

Name	In	Required	Type	Description
workspaceId	path	True	string	ID of the workspace. This is Workspace ID from the Properties blade in the Azure portal.

Request Header

Name	Required	Type	Description
Prefer		string	Optional. The prefer header to set server timeout, query statistics and visualization information.

Request Body

Name	Required	Type	Description
query	True	string	The query to execute.
timespan		string	Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.
workspaces		string[]	A list of workspaces that are included in the query.

Responses

Name	Type	Description
200 OK	queryResults	OK. The API call succeeded and the Analytics query result is in the response payload
Other Status Codes	errorResponse	An error response object.

Security

oauth2

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

cross-workspace

simple-query

cross-workspace

Sample request

HTTP

POST https://api.loganalytics.io/v1/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query

{
  "query": "union * | where TimeGenerated > ago(1h) | summarize count() by Type, TenantId",
  "workspaces": [
    "draft-test",
    "draft-test-2"
  ]
}

Sample response

Status code:: 200

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "count_",
          "type": "long"
        }
      ],
      "rows": [
        [
          "Usage",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "Usage",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "BillingFact",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "BillingFact",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "Operation",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "7"
        ],
        [
          "Operation",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "5"
        ]
      ]
    }
  ]
}

simple-query

Sample request

HTTP

POST https://api.loganalytics.io/v1/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query

{
  "query": "Usage | take 10",
  "timespan": "PT12H"
}

Sample response

Status code:: 200

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "Computer",
          "type": "string"
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "SourceSystem",
          "type": "string"
        },
        {
          "name": "StartTime",
          "type": "datetime"
        },
        {
          "name": "EndTime",
          "type": "datetime"
        },
        {
          "name": "ResourceUri",
          "type": "string"
        },
        {
          "name": "LinkedResourceUri",
          "type": "string"
        },
        {
          "name": "DataType",
          "type": "string"
        },
        {
          "name": "Solution",
          "type": "string"
        },
        {
          "name": "BatchesWithinSla",
          "type": "long"
        },
        {
          "name": "BatchesOutsideSla",
          "type": "long"
        },
        {
          "name": "BatchesCapped",
          "type": "long"
        },
        {
          "name": "TotalBatches",
          "type": "long"
        },
        {
          "name": "AvgLatencyInSeconds",
          "type": "real"
        },
        {
          "name": "Quantity",
          "type": "real"
        },
        {
          "name": "QuantityUnit",
          "type": "string"
        },
        {
          "name": "IsBillable",
          "type": "bool"
        },
        {
          "name": "MeterId",
          "type": "string"
        },
        {
          "name": "LinkedMeterId",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        }
      ],
      "rows": [
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "ContosoSQLSrv1",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.286",
          "0.076408",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ],
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "Store010Web3",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.7",
          "0.106767",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ]
      ]
    }
  ]
}

Definitions

Name	Description
column	A table column.
errorDetail	Error details.
errorInfo	The code and message for an error.
errorResponse	Error details.
logsColumnType	The data type of this column.
queryBody	The Analytics query. Learn more about the Analytics query syntax
queryResults	A query response.
Render	Visualization data in JSON format.
Statistics	Statistics represented in JSON format.
table	A query response table.

column

A table column.

Name	Type	Description
name	string	The name of this column.
type	logsColumnType	The data type of this column.

errorDetail

Error details.

Name	Type	Description
additionalProperties	object	Additional properties that can be provided on the error details object
code	string	The error's code.
message	string	A human readable error message.
resources	string[]	Indicates resources which were responsible for the error.
target	string	Indicates which property in the request is responsible for the error.
value	string	Indicates which value in 'target' is responsible for the error.

errorInfo

The code and message for an error.

Name	Type	Description
additionalProperties	object	Additional properties that can be provided on the error info object
code	string	A machine readable error code.
details	errorDetail[]	error details.
innererror	errorInfo	The code and message for an error. Inner error details if they exist.
message	string	A human readable error message.

errorResponse

Error details.

Name	Type	Description
error	errorInfo	The code and message for an error. The error details.

logsColumnType

The data type of this column.

Name	Type	Description
bool	string
datetime	string
decimal	string
dynamic	string
guid	string
int	string
long	string
real	string
string	string
timespan	string

queryBody

The Analytics query. Learn more about the Analytics query syntax

Name	Type	Description
query	string	The query to execute.
timespan	string	Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.
workspaces	string[]	A list of workspaces that are included in the query.

queryResults

A query response.

Name	Type	Description
error	errorInfo	The code and message for an error.
render	Render	Visualization data in JSON format.
statistics	Statistics	Statistics represented in JSON format.
tables	table[]	The list of tables, columns and rows.

Render

Visualization data in JSON format.

Statistics

Statistics represented in JSON format.

table

A query response table.

Name	Type	Description
columns	column[]	The list of columns in this table.
name	string	The name of the table.
rows	object[]	The resulting rows from this query.

Share via

Query - Execute

URI Parameters

Request Header

Request Body

Responses

Security

oauth2

Scopes

Examples

cross-workspace

Sample request

Sample response

simple-query

Sample request

Sample response

Definitions

column

errorDetail

errorInfo

errorResponse

logsColumnType

queryBody

queryResults

Render

Statistics

table

Additional resources