Metadata - Get

Gets metadata information
Retrieve the metadata information for the workspace, including its schema, functions, workspace info, categories etc.

GET https://api.loganalytics.io/v1/workspaces/{workspaceId}/metadata

URI Parameters

Name In Required Type Description
workspaceId
path True

string

ID of the workspace. This is Workspace ID from the Properties blade in the Azure portal.

Responses

Name Type Description
200 OK

metadataResults

OK. The API call succeeded and the metadata result is in the response payload

Other Status Codes

errorResponse

An error response object.

Security

oauth2

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

metadataGet

Sample request

GET https://api.loganalytics.io/v1/workspaces/b438b4f6-912a-46d5-9cb1-b44069212abc/metadata

Sample response

{
  "tables": [
    {
      "id": "ADAssessmentRecommendation",
      "name": "ADAssessmentRecommendation",
      "description": "Recommendations generated by AD assessments that are started through a scheduled task. When you schedule the assessment it runs by default every 7 days and upload the data into Azure Log Analytics",
      "timespanColumn": "TimeGenerated",
      "columns": [
        {
          "name": "SourceSystem",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AssessmentId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Recommendation",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Description",
          "type": "string"
        },
        {
          "name": "RecommendationResult",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "FocusAreaId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "FocusArea",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ActionAreaId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ActionArea",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationWeight",
          "type": "real"
        },
        {
          "name": "Computer",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AffectedObjectType",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AffectedObjectName",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Forest",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Domain",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "DomainController",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Technology",
          "type": "string"
        },
        {
          "name": "CustomData",
          "type": "string"
        },
        {
          "name": "TargetCount",
          "type": "int"
        },
        {
          "name": "IsRollup",
          "type": "bool",
          "isPreferredFacet": true
        },
        {
          "name": "IsCopied",
          "type": "bool",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationPeriod",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "_ResourceId",
          "type": "string"
        }
      ],
      "related": {
        "categories": [
          "workloads"
        ],
        "solutions": [
          "ADAssessment"
        ],
        "resourceTypes": [
          "microsoft.compute/virtualmachines"
        ]
      }
    },
    {
      "id": "custom_CL",
      "name": "custom_CL",
      "timespanColumn": "TimeGenerated",
      "columns": [
        {
          "name": "SourceSystem",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ManagementGroupName",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "TimeGenerated",
          "type": "datetime",
          "isPreferredFacet": true
        },
        {
          "name": "Computer",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RawData",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "_ResourceId",
          "type": "string"
        }
      ],
      "related": {
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "solutions": [
    {
      "id": "ADAssessment",
      "name": "ADAssessment",
      "displayName": "Active Directory Health Check",
      "description": "Assess the risk and health of Active Directory environments.",
      "related": {
        "tables": [
          "ADAssessmentRecommendation"
        ],
        "functions": [
          "dwad"
        ],
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "functions": [
    {
      "id": "dwad",
      "name": "dwad",
      "displayName": "dasd",
      "body": "Heartbeat\r\n| where ResourceGroup != \"rg-SAP-DEVQA-005\" and ResourceGroup != \"rg-SAP-DEVQA-006\" and Computer contains \"\"\r\n| limit 500000\r\n| sort by Computer asc\r\n| distinct Computer\r\n",
      "related": {
        "solutions": [
          "ADAssessment"
        ],
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "resourceTypes": [
    {
      "id": "microsoft.compute/virtualmachines",
      "type": "Microsoft.Compute/VirtualMachines",
      "displayName": "Virtual machines",
      "related": {
        "tables": [
          "ADAssessmentRecommendation"
        ]
      }
    }
  ],
  "workspaces": [
    {
      "id": "b438b4f6-912a-46d5-9cb1-b44069212abc",
      "resourceId": "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourceGroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-IT",
      "name": "contosoretail-IT",
      "region": "eastus",
      "related": {
        "resourceTypes": [
          "microsoft.compute/virtualmachines"
        ],
        "tables": [
          "custom_CL"
        ],
        "solutions": [
          "ADAssessment"
        ],
        "functions": [
          "dwad"
        ]
      }
    }
  ],
  "categories": [
    {
      "id": "workloads",
      "displayName": "Workloads",
      "related": {
        "tables": [
          "ADAssessmentRecommendation",
          "ADReplicationResult",
          "SQLAssessmentRecommendation",
          "WorkloadMonitoringPerf"
        ]
      }
    }
  ]
}

Definitions

Name Description
Applications

The permission indication for the Application Insights apps on the metadata request.

Columns

The list of columns defined on the table

errorDetail

Error details.

errorInfo

The code and message for an error.

errorResponse

Error details.

metadataApplication

An Application Insights application.

metadataCategory

A metadata category.

MetadataColumnDataType

The data type of the column

metadataFunction

A stored function.

metadataPermissions

Permission information.

metadataQuery

A stored query.

metadataResourceType

A type of resource in Azure.

metadataResults

A metadata response.

metadataSolution

A Log Analytics solution.

metadataTable

A data table that takes part in a workspace schema.

metadataWorkspace

A Log Analytics workspace.

Related

The related metadata items for the category

Resources

The permission indication for the Azure resources on the metadata request.

Workspaces

The permission indication for the workspaces on the metadata request.

Applications

The permission indication for the Application Insights apps on the metadata request.

Name Type Description
resourceId

string

The resource ID on the permission indication.

Columns

The list of columns defined on the table

Name Type Description
description

string

The description of the column

isPreferredFacet

boolean

A flag indicating this column is a preferred facet

name

string

The name of the column

source

object

an indication of the source of the column, used only when multiple workspaces have conflicting definition for the column

type

MetadataColumnDataType

The data type of the column

errorDetail

Error details.

Name Type Description
additionalProperties

object

Additional properties that can be provided on the error details object

code

string

The error's code.

message

string

A human readable error message.

resources

string[]

Indicates resources which were responsible for the error.

target

string

Indicates which property in the request is responsible for the error.

value

string

Indicates which value in 'target' is responsible for the error.

errorInfo

The code and message for an error.

Name Type Description
additionalProperties

object

Additional properties that can be provided on the error info object

code

string

A machine readable error code.

details

errorDetail[]

error details.

innererror

errorInfo

The code and message for an error.
Inner error details if they exist.

message

string

A human readable error message.

errorResponse

Error details.

Name Type Description
error

errorInfo

The code and message for an error.
The error details.

metadataApplication

An Application Insights application.

Name Type Description
id

string

The ID of the Application Insights app.

name

string

The name of the Application Insights app.

region

string

The Azure region of the Application Insights app.

related

Related

The related metadata items for the Application Insights app.

resourceId

string

The ARM resource ID of the Application Insights app.

metadataCategory

A metadata category.

Name Type Description
description

string

The description of the category

displayName

string

The display name of the category

id

string

The ID of the category

related

Related

The related metadata items for the category

MetadataColumnDataType

The data type of the column

Name Type Description
bool

string

datetime

string

decimal

string

dynamic

string

guid

string

int

string

long

string

real

string

string

string

timespan

string

metadataFunction

A stored function.

Name Type Description
body

string

The KQL body of the function.

description

string

The description of the function.

displayName

string

The display name of the function.

id

string

The ID of the function.

name

string

The name of the function, to be used in queries.

parameters

string

The parameters/arguments of the function, if any.

properties

object

The properties of the function.

related

Related

The related metadata items for the function.

tags

object

The tags associated with the function.

metadataPermissions

Permission information.

Name Type Description
applications

Applications[]

The permission indication for the Application Insights apps on the metadata request.

resources

Resources[]

The permission indication for the Azure resources on the metadata request.

workspaces

Workspaces[]

The permission indication for the workspaces on the metadata request.

metadataQuery

A stored query.

Name Type Description
body

string

The KQL body of the query.

description

string

The description of the query.

displayName

string

The display name of the query.

id

string

The ID of the query.

labels

string[]

The user defined labels associated with the query.

properties

object

The properties of the query.

related

Related

The related metadata items for the query.

tags

object

The tags associated with the query.

metadataResourceType

A type of resource in Azure.

Name Type Description
description

string

The description of the resource-type

displayName

string

The display name of the resource-type

id

string

The ID of the resource-type

labels

string[]

The user-defined labels of the resource-type

properties

object

The properties of the resource-type

related

Related

The related metadata items for the resource-type

tags

object

The tags associated with the resource-type

type

string

The type of the resource-type

metadataResults

A metadata response.

Name Type Description
applications

metadataApplication[]

The list of Application Insights apps that were referenced in the metadata request.

categories

metadataCategory[]

The list of categories that are referenced in this metadata response.

functions

metadataFunction[]

The list of functions stored on the workspace, or introduced by solutions etc.

permissions

metadataPermissions[]

The list of permission rules that affected the metadata request.

queries

metadataQuery[]

The list of saved queries stored on the workspace, or introduced by solutions, resource types, etc.

resourceTypes

metadataResourceType[]

The list of resource types that are referenced in this metadata response.

resources

metadataResource[]

The list of Azure resources that were referenced in the metadata request.

solutions

metadataSolution[]

The list of Log Analytics solutions installed on the workspace.

tables

metadataTable[]

The list of tables and columns that comprise the schema of the workspace.

workspaces

metadataWorkspace[]

The list of Log Analytics workspaces that were referenced in the metadata request.

metadataSolution

A Log Analytics solution.

Name Type Description
description

string

The description of the Log Analytics solution

displayName

string

The display name of the Log Analytics solution

id

string

The ID of the Log Analytics solution

name

string

The name of the Log Analytics solution

properties

object

The properties of the Log Analytics solution

related

Related

The related metadata items for the Log Analytics solution

tags

object

The tags that are associated with the Log Analytics solution

metadataTable

A data table that takes part in a workspace schema.

Name Type Description
columns

Columns[]

The list of columns defined on the table

description

string

The description of the table

id

string

The ID of the table

labels

string[]

The user defined labels of the table

name

string

The name of the table

properties

object

The properties of the table

related

Related

The related metadata items for the table

tags

object

The tags associated with the table

timespanColumn

string

The column associated with the timespan query parameter for the table

metadataWorkspace

A Log Analytics workspace.

Name Type Description
id

string

The ID of the Log Analytics workspace.

name

string

The name of the Log Analytics workspace.

region

string

The Azure region of the Log Analytics workspace.

related

Related

The related metadata items for the Log Analytics workspace.

resourceId

string

The ARM resource ID of the Log Analytics workspace.

The related metadata items for the category

Name Type Description
functions

string[]

The functions related to the category

queries

string[]

The saved queries related to the category

resourceTypes

string[]

The resource types related to the category

solutions

string[]

The Log Analytics solutions related to the category

tables

string[]

The tables related to the category

Resources

The permission indication for the Azure resources on the metadata request.

Name Type Description
denyTables

string[]

The list of tables that were denied access for the resource ID.

resourceId

string

The resource ID on the permission indication.

Workspaces

The permission indication for the workspaces on the metadata request.

Name Type Description
denyTables

string[]

The list of tables that were denied access for the resource ID.

resourceId

string

The resource ID on the permission indication.