Understanding the Azure Resource Graph query language

The query language for the Azure Resource Graph supports a number of operators and functions. Each work and operate based on Azure Data Explorer.

The best way to learn about the query language used by Resource Graph is to start with the documentation for the Azure Data Explorer Query Language. It provides an understanding about how the language is structured and how the various supported operators and functions work together.

Supported tabular operators

Here is the list of supported tabular operators in Resource Graph:

Supported functions

Here is the list of supported functions in Resource Graph:

Escape characters

Some property names, such as those that include a . or $, must be wrapped or escaped in the query or the property name is interpreted incorrectly and doesn't provide the expected results.

  • . - Wrap the property name as such: ['propertyname.withaperiod']

    Example query that wraps the property odata.type:

    where type=~'Microsoft.Insights/alertRules' | project name, properties.condition.['odata.type']
  • $ - Escape the character in the property name. The escape character used depends on the shell Resource Graph is run from.

    • bash - \

      Example query that escapes the property $type in bash:

      where type=~'Microsoft.Insights/alertRules' | project name, properties.condition.\$type
    • cmd - Don't escape the $ character.

    • PowerShell - `

      Example query that escapes the property $type in PowerShell:

      where type=~'Microsoft.Insights/alertRules' | project name, properties.condition.`$type

Next steps