檢視或分析以 Log Analytics 記錄搜尋所收集的資料View or analyze data collected with Log Analytics log search

在 Log Analytics 中,您可以建構查詢以分析收集到的資料來利用記錄搜尋,使用可以最有價值搜尋的圖形檢視來自訂的既存儀表板。In Log Analytics you can leverage log searches by constructing queries to analyze the collected data, use pre-existing dashboards which you can customize with graphical views of your most valuable searches. 您現在已定義從 Azure VM 和活動記錄收集的操作資料,在本教學課程中,您了解如何:Now that you have defined collection of operational data from your Azure VMs and Activity Logs, in this tutorial you learn how to:

  • 執行事件資料的簡單搜尋,並使用功能來修改和篩選結果Perform a simple search of event data and use features to modify and filter the results
  • 瞭解如何使用效能資料Learn how to work with performance data

若要完成本教學課程中的範例,您目前必須有連線至 Log Analytics 工作區的虛擬機器。To complete the example in this tutorial, you must have an existing virtual machine connected to the Log Analytics workspace.

除了以互動方式使用傳回的資料之外,還可以使用其中一種方式建立和編輯查詢。Creating and editing queries, in addition to working interactively with returned data, can be accomplished one of two ways. 若是基本查詢,請在 Azure 入口網站中使用 [記錄搜尋] 頁面,若是進階查詢,則可以使用進階分析入口網站。For basic queries, use the Log Search page in the Azure portal, or for advanced querying, you can use the Advanced Analytics portal. 若要深入了解兩個入口網站之間的功能差異,請參閱 Azure Log Analytics 中用於建立和編輯記錄查詢的入口網站To learn more about the difference in functionality between the two portals, see Portals for creating and editing log queries in Azure Log Analytics

在本教學課程中,我們將在 Azure 入口網站中使用 [記錄搜尋]。In this tutorial, we will be working with Log Search in the Azure portal.

登入 Azure 入口網站Log in to Azure portal

https://portal.azure.com 上登入 Azure 入口網站。Log in to the Azure portal at https://portal.azure.com.

開啟記錄搜尋入口網站Open the Log Search portal

從開啟記錄搜尋入口網站開始。Start by opening the Log Search portal.

  1. 在 Azure 入口網站中,按一下 [所有服務]。In the Azure portal, click All services. 在資源清單中輸入 [監視器]。In the list of resources, type Monitor. 當您開始輸入時,清單會根據您輸入的文字進行篩選。As you begin typing, the list filters based on your input. 選取 [監視器]。Select Monitor.
  2. 在 [監視器] 導覽功能表上,選取 [Log Analytics],然後選取工作區。On the Monitor navigation menu, select Log Analytics and then select a workspace.

若要擷取某些資料來使用,最快的方式是使用會傳回資料表中所有記錄的簡單查詢。The quickest way to retrieve some data to work with is a simple query that returns all records in table. 如果有任何 Windows 或 Linux 用戶端連線到您的工作區,則您會擁有事件 (Windows) 或 Syslog (Linux) 資料表中的資料。If you have any Windows or Linux clients connected to your workspace, then you'll have data in either the Event (Windows) or Syslog (Linux) table.

在搜尋方塊中輸入以下其中一項查詢,然後按一下搜尋按鈕。Type one the following queries in the search box and click the search button.


資料會傳回到預設清單檢視中,您可以看到傳回的記錄總數。Data is returned in the default list view, and you can see how many total records were returned.


每筆記錄只會顯示前幾個屬性。Only the first few properties of each record are displayed. 按一下 [顯示更多] 以顯示特定記錄的所有屬性。Click show more to display all properties for a particular record.

篩選查詢結果Filter results of the query

畫面左側是篩選窗格,可讓您新增篩選條件到查詢中,而不需要直接修改查詢。On the left side of the screen is the filter pane which allows you to add filtering to the query without modifying it directly. 對於該記錄類型會顯示數個記錄屬性,您可以選取一個或多個屬性值,以縮小搜尋結果。Several record properties are displayed for that record type, and you can select one or more property values to narrow your search results.

如果您使用的是事件,選取 [EVENTLEVELNAME] 下方 [錯誤] 旁的核取方塊。If you're working with Event, select the checkbox next to Error under EVENTLEVELNAME. 如果您使用的是 Syslog,選取 [SEVERITYLEVEL] 下方 [錯誤] 旁的核取方塊。If you're working with Syslog, select the checkbox next to err under SEVERITYLEVEL. 這會將查詢變更為下列其中一個,以將結果限制為錯誤事件。This changes the query to one of the following to limit the results to error events.

Event | where (EventLevelName == "Error")
Syslog | where (SeverityLevel == "err")


從其中一個記錄的屬性功能表中選取 [新增至篩選器],將屬性新增至篩選窗格。Add properties to the filter pane by selecting Add to filters from the property menu on one of the records.


您可以從記錄的屬性功能表選取具有所要篩選值的 [篩選],以設定相同的篩選條件。You can set the same filter by selecting Filter from the property menu for a record with the value you want to filter.

只有在將滑鼠移至上方時,名稱是藍色的屬性才會有 [篩選] 選項。You only have the Filter option for properties with their name in blue when you hover over them. 這些是可搜尋的欄位,已針對搜尋條件編列索引。These are searchable fields which are indexed for search conditions. 灰色的欄位是「自然語言檢索搜尋旗標」欄位,只有 [顯示參考] 選項。Fields in grey are free text searchable fields which only have the Show references option. 此選項會傳回在任何屬性中具有該值的記錄。This option returns records that have that value in any property.

您可以選取記錄功能表中的 [分組依據] 選項,在單一屬性上群組結果。You can group the results on a single property by selecting the Group by option in the record menu. 這會將摘要運算子新增到查詢中,可在圖表中顯示結果。This will add a summarize operator to your query that displays the results in a chart. 您可以群組一個以上的屬性,但需要直接編輯查詢。You can group on more than one property, but you would need to edit the query directly. 選取電腦屬性旁的記錄功能表,並選取 [Group by 'Computer'] (依「電腦」分組)。Select the record menu next the Computer property and select Group by 'Computer'.


處理結果Work with results

記錄搜尋入口網站有各種功能,以供使用查詢結果。The Log Search portal has a variety of features for working with the results of a query. 您可以排序、篩選和群組結果來分析資料,而不需修改實際的查詢。You can sort, filter, and group results to analyze the data without modifying the actual query. 根據預設,不會排序查詢的結果。Results of a query are not sorted by default.

若要以可提供其他篩選和排序選項的資料表形式來檢視資料,按一下 [資料表]。To view the data in table form which provides additional options for filtering and sorting, click Table.


按一下記錄旁的箭號以檢視該記錄的詳細資訊。Click the arrow by a record to view the details for that record.


按一下資料行標題,對欄位進行排序。Sort on any field by clicking on its column header.


按一下篩選按鈕並提供篩選條件,以篩選出資料行中具特定值的結果。Filter the results on a specific value in the column by clicking the filter button and providing a filter condition.


將資料行標題拖曳至結果上方,以群組資料行。Group on a column by dragging its column header to the top of the results. 您可以將多個資料行拖曳至上方,以群組多個欄位。You can group on multiple fields by dragging multiple columns to the top.


使用效能資料Work with performance data

Windows 和 Linux 代理程式的效能資料都儲存在 Log Analytics 工作區的效能資料表中。Performance data for both Windows and Linux agents is stored in the Log Analytics workspace in the Perf table. 效能記錄看起來就像其他任何記錄,我們即將撰寫會傳回所有效能記錄的簡單查詢,就像使用事件一樣。Performance records look just like any other record, and we are going to write a simple query that returns all performance records just like with events.



針對所有效能物件和計數器傳回數百萬筆記錄並不太實用。Returning millions of records for all performance objects and counters though isn't very useful. 您可以使用與上述相同的方法來篩選資料,或直接在 [記錄搜尋] 方塊中輸入下列查詢。You can use the same methods you used above to filter the data or just type the following query directly into the log search box. 這對於 Windows 和 Linux 電腦都只會傳回處理器使用率記錄。This returns only processor utilization records for both Windows and Linux computers.

Perf | where ObjectName == "Processor"  | where CounterName == "% Processor Time"


這可讓資料限制在特定的計數器,但仍無法以非常實用的形式來呈現資料。This limits the data to a particular counter, but it still doesn't put it in a form that's particularly useful. 您可透過折線圖顯示資料,但首先需要以 [電腦] 與 [TimeGenerated] 進行群組。You can display the data in a line chart, but first need to group it by Computer and TimeGenerated. 若要群組多個欄位,您需要直接修改查詢,因此,請將查詢修改如下。To group on multiple fields, you need to modify the query directly, so modify the query to the following. 這是在 CounterValue 屬性上使用 avg 函式來計算每小時的平均值。This uses the avg function on the CounterValue property to calculate the average value over each hour.

| where ObjectName == "Processor"  | where CounterName == "% Processor Time"
| summarize avg(CounterValue) by Computer, TimeGenerated


資料既已適當分組,您可以新增轉譯運算子,以視覺圖表來顯示資料。Now that the data is suitably grouped, you can display it in a visual chart by adding the render operator.

| where ObjectName == "Processor" | where CounterName == "% Processor Time" 
| summarize avg(CounterValue) by Computer, TimeGenerated 
| render timechart


後續步驟Next steps

在本教學課程中,您已了解如何建立基本的記錄搜尋來分析事件和效能資料。In this tutorial, you learned how to create basic log searches to analyze event and performance data. 前進到下一個教學課程,以了解如何建立儀表板,以視覺化方式呈現資料。Advance to the next tutorial to learn how to visualize the data by creating a dashboard.