Query - Execute

Execute an Analytics query
Executes an Analytics query for data. Here is an example for using POST with an Analytics query.

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query

URI Parameters

Name In Required Type Description
workspaceId
path True
  • string

ID of the workspace. This is Workspace ID from the Properties blade in the Azure portal.

Request Body

Name Required Type Description
query True
  • string

The query to execute.

timespan
  • string

Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.

workspaces
  • string[]

A list of workspaces that are included in the query.

Responses

Name Type Description
200 OK

OK. The API call succeeded and the Analytics query result is in the response payload

Other Status Codes

An error response object.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

cross-workspace
simple-query

cross-workspace

Sample Request

POST https://api.loganalytics.io/v1/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query
{
  "query": "union * | where TimeGenerated > ago(1h) | summarize count() by Type, TenantId",
  "workspaces": [
    "draft-test",
    "draft-test-2"
  ]
}

Sample Response

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "count_",
          "type": "long"
        }
      ],
      "rows": [
        [
          "Usage",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "Usage",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "BillingFact",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "1"
        ],
        [
          "BillingFact",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "1"
        ],
        [
          "Operation",
          "63613592-b6f7-4c3d-a390-22ba13102111",
          "7"
        ],
        [
          "Operation",
          "d436f322-a9f4-4aad-9a7d-271fbf66001c",
          "5"
        ]
      ]
    }
  ]
}

simple-query

Sample Request

POST https://api.loganalytics.io/v1/workspaces/63613592-b6f7-4c3d-a390-22ba13102111/query
{
  "query": "Usage | take 10",
  "timespan": "PT12H"
}

Sample Response

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "TenantId",
          "type": "string"
        },
        {
          "name": "Computer",
          "type": "string"
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "SourceSystem",
          "type": "string"
        },
        {
          "name": "StartTime",
          "type": "datetime"
        },
        {
          "name": "EndTime",
          "type": "datetime"
        },
        {
          "name": "ResourceUri",
          "type": "string"
        },
        {
          "name": "LinkedResourceUri",
          "type": "string"
        },
        {
          "name": "DataType",
          "type": "string"
        },
        {
          "name": "Solution",
          "type": "string"
        },
        {
          "name": "BatchesWithinSla",
          "type": "long"
        },
        {
          "name": "BatchesOutsideSla",
          "type": "long"
        },
        {
          "name": "BatchesCapped",
          "type": "long"
        },
        {
          "name": "TotalBatches",
          "type": "long"
        },
        {
          "name": "AvgLatencyInSeconds",
          "type": "real"
        },
        {
          "name": "Quantity",
          "type": "real"
        },
        {
          "name": "QuantityUnit",
          "type": "string"
        },
        {
          "name": "IsBillable",
          "type": "bool"
        },
        {
          "name": "MeterId",
          "type": "string"
        },
        {
          "name": "LinkedMeterId",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        }
      ],
      "rows": [
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "ContosoSQLSrv1",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.286",
          "0.076408",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ],
        [
          "b438b4f6-912a-46d5-9cb1-b44069212abc",
          "Store010Web3",
          "2017-08-24T06:59:59Z",
          "OMS",
          "2017-08-24T06:00:00Z",
          "2017-08-24T06:59:59Z",
          "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-it",
          null,
          "Perf",
          "LogManagement",
          "1",
          "0",
          "0",
          "1",
          "1.7",
          "0.106767",
          "MBytes",
          "true",
          "a4e29a95-5b4c-408b-80e3-113f9410566e",
          "00000000-0000-0000-0000-000000000000",
          "Usage"
        ]
      ]
    }
  ]
}

Definitions

column

A table column.

errorDetail

Error details.

errorInfo

The code and message for an error.

errorResponse

Error details.

queryBody

The Analytics query. Learn more about the Analytics query syntax

queryResults

A query response.

table

A query response table.

column

A table column.

Name Type Description
name
  • string

The name of this column.

type
  • string

The data type of this column.

errorDetail

Error details.

Name Type Description
additionalProperties
  • object
code
  • string

The error's code.

message
  • string

A human readable error message.

resources
  • string[]

Indicates resources which were responsible for the error.

target
  • string

Indicates which property in the request is responsible for the error.

value
  • string

Indicates which value in 'target' is responsible for the error.

errorInfo

The code and message for an error.

Name Type Description
additionalProperties
  • object
code
  • string

A machine readable error code.

details

error details.

innererror

The code and message for an error.
Inner error details if they exist.

message
  • string

A human readable error message.

errorResponse

Error details.

Name Type Description
error

The code and message for an error.
The error details.

queryBody

The Analytics query. Learn more about the Analytics query syntax

Name Type Description
query
  • string

The query to execute.

timespan
  • string

Optional. The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any that are specified in the query expression.

workspaces
  • string[]

A list of workspaces that are included in the query.

queryResults

A query response.

Name Type Description
tables

The list of tables, columns and rows.

table

A query response table.

Name Type Description
columns

The list of columns in this table.

name
  • string

The name of the table.

rows
  • array[]

The resulting rows from this query.