Understanding the Azure Resource Graph query language
The query language for the Azure Resource Graph supports a number of operators and functions. Each work and operate based on Azure Data Explorer.
The best way to learn about the query language used by Resource Graph is to start with the documentation for the Azure Data Explorer Query Language. It provides an understanding about how the language is structured and how the various supported operators and functions work together.
Supported tabular operators
Here is the list of supported tabular operators in Resource Graph:
- order by
- sort by
Here is the list of supported functions in Resource Graph:
Some property names, such as those that include a
$, must be wrapped or escaped in the
query or the property name is interpreted incorrectly and doesn't provide the expected results.
.- Wrap the property name as such:
Example query that wraps the property odata.type:
where type=~'Microsoft.Insights/alertRules' | project name, properties.condition.['odata.type']
$- Escape the character in the property name. The escape character used depends on the shell Resource Graph is run from.
Example query that escapes the property $type in bash:
where type=~'Microsoft.Insights/alertRules' | project name, properties.condition.\$type
cmd - Don't escape the
Example query that escapes the property $type in PowerShell:
where type=~'Microsoft.Insights/alertRules' | project name, properties.condition.`$type