Run Azure log query from the command line with Azure CLI (az monitor)-CodePudding

I am trying to get the Azure log query data from the CLI because we want to get the log message automatically. For example, when we want to get exceptions message, we will got to Azure log and run the query like this

However, in powershell, when I run az monitor log-analytics query -w 0000000000000 --analytics-query "exceptions" (000 is the workspace ID)
then I got an error message BadArgumentError: The request had some invalid properties. But I did not get the error message when I use Azure Dashboard.

How would I modify my query? Or should I use a different function?

Thanks in advance

CodePudding user response：

After looking at your query I see you are merging two services(i.e., Log Analytics and Application Insights). You are using log analytics command for Application insights query. Instead, you can use the below command for errors and exceptions in your Log Analytics logs.

FunctionAppLogs 
| where TimeGenerated > ago(1h)
| where Level == "Warning" or Level == "Error"
| summarize count_per_app = count() by _ResourceId
| sort by count_per_app desc 
| render columnchart

You can use the below CLI Command as an example:

az monitor log-analytics query -w XXXXX --analytics-query "FunctionAppLogs | where TimeGenerated > ago(1h)| where Level == 'Warning' or Level == 'Error'| summarize count_per_app = count() by _ResourceId| sort by count_per_app desc | render columnchart"

Output:

CodePudding user response：

You need to project the application insights data to the log analytics workspace by enabling the diagnostic settings to a particular table.

enter image description here

In our case we have only requests table which has the data and i have routed that telemetry to log analytics once the data got shifted, we see that a new table was created under log analytics with name "AppRequests" and using the below query I am able to pull the data from the application insights query below:

az monitor log-analytics query -w xxx-xx-x-xx --analytics-query "AppRequests| where TimeGenerated >=ago(1h)| take 5"

Below is the sample output screen:

enter image description here

Note: You can replace the "AppRequests" based on your requirement.