Automate Azure Monitor log processes with the connector for Microsoft Flow

Microsoft Flow allows you to create automated workflows using hundreds of actions for a variety of services. Output from one action can be used as input to another allowing you to create integration between different services. The Azure Log Analytics connector for Microsoft Flow allow you to build workflows that include data retrieved by log queries from a Log Analytics workspace in Azure Monitor.


This article was recently updated to use the term Azure Monitor logs instead of Log Analytics. Log data is still stored in a Log Analytics workspace and is still collected and analyzed by the same Log Analytics service. We are updating the terminology to better reflect the role of logs in Azure Monitor. See Azure Monitor terminology changes for details.

For example, you can use Microsoft Flow to use LAzure Monitor log data in an email notification from Office 365, create a bug in Azure DevOps, or post a Slack message. You can trigger a workflow by a simple schedule or from some action in a connected service such as when a mail or a tweet is received.

The tutorial in this article shows you how to create a flow that automatically sends the results of an Azure Monitor log query by email, just one example of how you can use the Log Analytics connector in Microsoft Flow.

Step 1: Create a flow

  1. Sign in to Microsoft Flow, and select My Flows.
  2. Click + Create from blank.

Step 2: Create a trigger for your flow

  1. Click Search hundreds of connectors and triggers.
  2. Type Schedule in the search box.
  3. Select Schedule, and then select Schedule - Recurrence.
  4. In the Frequency box select Day and in the Interval box, enter 1.

    Microsoft Flow trigger dialog box

Step 3: Add a Log Analytics action

  1. Click + New step, and then click Add an action.
  2. Search for Log Analytics.
  3. Click Azure Log Analytics – Run query and visualize results.

    Log Analytics run query window

Step 4: Configure the Log Analytics action

  1. Specify the details for your workspace including the Subscription ID, Resource Group, and Workspace Name.

  2. Add the following log query to the Query window. This is only a sample query, and you can replace with any other that returns data.

     | where EventLevelName == "Error" 
     | where TimeGenerated > ago(1day)
     | summarize count() by Computer
     | sort by Computer
  3. Select HTML Table for the Chart Type.

    Log Analytics action

Step 5: Configure the flow to send email

  1. Click New step, and then click + Add an action.

  2. Search for Office 365 Outlook.

  3. Click Office 365 Outlook – Send an email.

    Office 365 Outlook selection window

  4. Specify the email address of a recipient in the To window and a subject for the email in Subject.

  5. Click anywhere in the Body box. A Dynamic content window opens with values from previous actions.

  6. Select Body. This is the results of the query in the Log Analytics action.

  7. Click Show advanced options.

  8. In the Is HTML box, select Yes.

    Office 365 email configuration window

Step 6: Save and test your flow

  1. In the Flow name box, add a name for your flow, and then click Create flow.

    Save flow
  2. The flow is now created and will run after a day which is the schedule you specified.
  3. To immediately test the flow, click Run Now and then Run flow.

    Run flow
  4. When the flow completes, check the mail of the recipient that you specified. You should have received a mail with a body similar to the following:

    Sample email

Next steps