Log Analytics and KQL Fundamentals

A Log Analytics workspace is the central data store in Azure Monitor for log and telemetry data. When you configure diagnostic settings on an Azure resource, the structured logs and metrics flow into the workspace. You can then query the data using the Kusto Query Language (KQL). A workspace has its own retention policy (default 30 days, up to 730 days) and access controls.

Every Azure resource can emit diagnostic logs — detailed records of operations such as API calls, authentication events, and query execution. You enable them through Diagnostic Settings on the resource, specifying the destination as your Log Analytics workspace. Common log categories include AuditEvent for Key Vault, AppServiceHTTPLogs for App Service, and NetworkSecurityGroupFlowEvent for NSGs.

Kusto Query Language (KQL) is a read-only query language for analysing log data. A KQL query reads left-to-right as a pipeline: start with a table name, then pipe (|) through operators. Common operators include where for filtering, project for selecting columns, summarize for aggregation, and order by for sorting. KQL is case-sensitive for column names but not for keywords.

The where operator filters rows using boolean expressions. You can combine conditions with and, or, and not. The has operator performs case-insensitive word-boundary search in strings, while contains does a substring search. The in operator tests membership in a list. Use ago() to express relative time ranges like ago(1h) or ago(7d).

The summarize operator computes aggregations across rows. Common aggregation functions include count(), sum(), avg(), max(), min(), and dcount() for distinct count. You can group by one or more columns using the by clause. The bin() function rounds timestamps to intervals for time-series aggregation.

KQL supports join to correlate data from multiple tables. The default join kind is innerunique but you can specify inner, leftouter, rightouter, or fullouter. A common pattern is joining AzureActivity with AzureMetrics to correlate administrative changes with performance dips. The lookup operator is a lighter-weight alternative for enriching rows from a small reference table.

After writing a query in the Log Analytics portal, you can render results as a time chart, bar chart, pie chart, or table using the render operator. You can also pin any query result to an Azure Dashboard or save it as a Workbook. The render timechart command turns a time-series summarize query into an instant line chart for trend analysis.

Log search alerts run a KQL query on a schedule and fire when the result meets a condition, such as result count greater than zero or a numeric column exceeding a threshold. They are more flexible than metric alerts because you can query any log data across multiple tables. Evaluation frequency and time window are independently configurable — for example, run every 5 minutes over the last 15 minutes.

Azure Monitor stores logs in well-known tables. AzureActivity records subscription-level operations. SecurityEvent contains Windows Security logs from VMs with the Log Analytics agent. Heartbeat shows agent connectivity (one row per minute per connected VM). AppRequests, AppExceptions, and AppDependencies come from Application Insights. Knowing these table names is essential for writing effective operational queries.

Log Analytics pricing has two components: data ingestion (per GB ingested) and data retention (first 30 days are free, then charged per GB per month beyond the default). You can reduce costs by filtering noisy log categories before ingestion, using Basic Logs for high-volume low-value data at a reduced price, and archiving older data to Azure Data Explorer or cold storage for long-term compliance retention.

Log Analytics workspaces support two access control models. In workspace-context mode, a user with Read access to the workspace can query all tables. In resource-context mode, a user can query only the logs emitted by resources they have RBAC permission to read — even without explicit workspace access. Resource-context mode is recommended for large organisations where different teams own different resources.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Log Analytics workspaces centralise diagnostic log data from Azure resources, KQL operators like where, summarize, and render let you filter, aggregate, and visualise logs, and log search alerts trigger automated responses when a KQL query result meets a defined condition. Next up we explore Application Insights for application-level telemetry.