How to use the Azure Monitor Logs tile

About Azure Monitor Logs tiles

The Azure Monitor Logs tile allows you to query Log Analytics data from Azure Monitorand display that information as part of your SquaredUp dashboard.

The Azure Monitor Logs tile queries Log Analytics using the new query language (KQL).

The ability to render information as a graph is a feature of the Azure portal rather than the Log Analytics Query language itself. Graphs will only be shown if you have selected a suitable graph tile such as the Log Analytics Line Graph or Log Analytics Donut.

How to configure an Azure Monitor Logs tile

1. Add a new tile to a dashboard and choose the Logs tile.

   

   1. Choose the visualisation for your Azure Monitor Logs tile:

      Scalar

      A single value such as a number of customers or incidents.

      Example:

      

      Grid

      A table of data, e.g. incidents.

      Example:

      

      Line Graph

      Shows data over time, in a graph with an x-axis (time) and a y-axis. You can show several objects, such as servers, in one graph.

      Example:

      

      Bar Graph

      Visualises both a number and the resulting bar width based on the number value.

      Example:

      

      Donut

      Shows the results in a donut shape.

      Donuts can display a maximum of 10 items.

      Example:

      

      Status Icons

      Shows the state of items as icons with different colours. You can display the icons alone or together with a description.

      Example:

      

      

       

      Status Blocks

      Shows the state of items as blocks with different colours.

      Example:

      

      

2. Scope:

   The scope is optional, and allows you to specify a scope of SCOM objects, which can be used later in the tile configuration to insert SCOM object properties into the query using mustache syntax.

   If you use a scope ensure that it contains objects monitored by Azure Log Analytics.

   See How to scope tiles

3. Timeframe:

   Here you determine the timeframe for the search query.
   The default timeframe uses the dynamic page timeframe.

   Take care when using a long timeframe, as this may pull many thousands of entries and significantly impact browser performance.

   If your query doesn't specify a timeframe

   Set the timeframe to use page timeframe to make the search query adapt to the dynamic page timeframe or set the timeframe to specific timeframe to choose a fixed timeframe. In this case, the search query will ignore the current page timeframe.

   If you are using the page timeframe,you can add a "clamping" timeframe in the query (such as where timestamp >= ago(7d)). When the page timeframe is less than 7 days it will be used, but once the page timeframe exceeds 7 days the query will enforce the max time.

   If your query specifies a timeframe

   If you specify a timeframe in the query (e.g. where timestamp >= ago(2h)), events must satisfy both the timeframe you set here and in the where clause in your query.

   If you want to control the timeframe using only the query, set the tile timeframe to time range > al

4. Workspace:

   Pick the workspace you want to query from the drop-down list. For more information see Create a Log Analytics workspace in the Azure portal.
   It is not possible to query multiple workspaces on a single tile, because the Azure API in use does not support cross-resource queries.

5. Query:

   Test your query in the Log Analytics workspace in the Azure portal to be sure it returns the results expected. You can find many sample queries in this area of the portal.

   Copy and paste the tested query into the Azure Log Analytics tile query box.

   view in portal button:
   Opens the specified workspace in the Azure portal in a new tab. From here you can test any query to be sure it returns the results expected, then save the query to the workspace, so it is ready to be accessed from SquaredUp using the saved searches button.

    saved searches button:
   Will list all searches saved in the selected workspace. This is a quick and easy way to pull a query from the logs workspace into SquaredUp, where it can be edited if required.

   How to write an Azure Log Analytics query

   The Azure Monitor Logs tile queries Log Analytics using the new query language (KQL).

   KQL, Kusto, is very rich and offers features such as sorting, projection and calculated values, which you can use to control the display of data in your dashboard.

   For more information see Microsoft Azure Monitor log queries article - it provides links to other resources for learning how to write queries.

   How to include the scope in a query

   Queries can include Mustache syntax to create a dynamic query that will change depending on the object being viewed. After typing {{ the mustache helper will appear, see below. This is particularly useful on perspectives where you can insert the object name as a variable using mustache syntax.

   When specifying a mustache clicking the {{}} button or typing {{ brings up a helpful picker which shows all the properties of your selected object, along with sample values. It also includes a suggested mustache for creating a dynamic list of names which is useful if the tile is scoped to more than one object (such as a list, group, Enterprise Application, or class).

   Once the mustache helper is displayed, the list of properties will automatically filter based on what you type, allowing you to quickly find a property using a partial name or likely term. Clicking an item in the list will automatically insert that property into your query and complete the mustache.

   For example, if you have specified a computer in the scope section you can insert the computer name into the query using {{scope[0].displayName}} or on a perspective use {{displayName}} to create a dynamic query scoped to the object being viewed.

   Property names are case-sensitive and should be written as they appear in the mustache helper (e.g. displayName not DisplayName).

   Queries for Scalars

   Your query must return a single figure.

   Queries for Status Icons or Blocks

   The return data must include a state column which must contain the following values:

   healthy, critical, and/or warning (the values are not case-sensitive). Any other values will result in state unknown.

   The state values define the colour of the status icons or blocks:

   Healthy	green
   Critical	yellow
   Warning	red
   Unknown	grey

   Queries and Column Overrides for Line Graphs

   Your query must return as a minimum a DateTime field and a Numeric value field.

   Column Overrides

   Here you define how the returned data is grouped and displayed. Use the dropdowns to specify which data/column you want to use:

   timestamp	Here you define the time series for the x-axis of the graph.
   value	Here you define which value the graph will show for the y-axis. For example, if you want to see the response time of different servers, your metric would be response time. If you want to see the amount of tickets, your metric would be amount (of tickets). show all: If there are multiple values, you can display these by ticking this box.
   grouping	Here you define what "things" you want the graph to represent. For example, if you want to see the response time of different servers, the grouping would be servers. If you want to see the amount of tickets, your grouping would be tickets.

   Queries and Column Overrides for Bar Graphs

   Your query must return a numeric field for the value and a string for grouping.

   You can choose to sort or not sort the results using the KQL query, for example:

   | top 5 by max_counterValue asc

   Column Overrides

   Here you define how the returned data is grouped and displayed. Use the dropdowns to specify which data/column you want to use:

   value	Here you define which value the graph will show for the y-axis. For example, if you want to see the response time of different servers, your metric would be response time. If you want to see the amount of tickets, your metric would be amount (of tickets). Only for Bar Graphs: show all: If there are multiple values, you can display these by ticking this box.
   grouping	Here you define what "things" you want the graph to represent. For example, if you want to see the response time of different servers, the grouping would be servers. If you want to see the amount of tickets, your grouping would be tickets.

   Queries and Column Overrides for Donuts

   Your query must return a numeric field for the value and a string for grouping.

   Queries for donuts should return a maximum of 10 categories. This can be achieved by using the top or limit operators in your query.

   Column Overrides

   Here you define how the returned data is grouped and displayed. Use the dropdowns to specify which data/column you want to use:

   value	Here you define which value the graph will show for the y-axis. For example, if you want to see the response time of different servers, your metric would be response time. If you want to see the amount of tickets, your metric would be amount (of tickets). Only for Bar Graphs: show all: If there are multiple values, you can display these by ticking this box.
   grouping	Here you define what "things" you want the graph to represent. For example, if you want to see the response time of different servers, the grouping would be servers. If you want to see the amount of tickets, your grouping would be tickets.

6. Configure the settings for your visualisation:

   Scalar

   Font size	Allows you to set the font size of the value in the tile.
   Unit	Allows you to add a unit to the value displayed in the Scalar tile. For example, if your value shows a time in milliseconds, you can enter "ms" or if your value shows pageviews, you can enter "pageviews".
   Value formatter	Allows you to format the value by using the mustache picker. For example, you can round the value up or down or convert it.

   Grid

   Grid colums

   Grid columns opens the grid designer, where you can show or hide columns, change the order of columns, edit column names or add custom columns.

   Grid options

   Row link

   Allows you to turn the graph items ( for example, the status blocks or the rows of a grid) into hyperlinks that lead you to more information about each item. For example, when you create a status tile for ServiceNow tickets, you can link each icon or block to the corresponding ticket. A click on the icon or block then opens the ticket in ServiceNow. To find out how the URL has to look like, take the URL to a specific ticket (or any other object you want to link to) as a template. Find the object ID in the URL and replace it with the value from the object ID column. You can use the mustache picker to select the object that contains the object ID. Example: The URL to a specific ticket is: https://my-ticket-system.com/ticketID-123456 The column that contains the ticket ID is called sys_id In this case, the URL would look like this: https://my-ticket-system.com/ticketID-{{sys_id}}

   Show column headers

   You can choose between showing or hiding the header for all columns.

   Line Graph

   Data range

   The Data Range option allows you to choose the range of data the graph will display. For line graphs, this means the data on the y-axis.

   percentage	Shows 0 to 100
   fit to data	Shows the data minimum to data maximum
   fit to data (from zero)	Shows from 0 to the data maximum
   custom	Allows you to specify the min and max
   custom fit	Allows you to specify the min and max limits, so that data outside your settings will not be shown. If all the data falls within your specified ranges then the y-axis range will fit to the data rather than your caps.

   Display

   Height: Allows you to set the height of the tile with a slider.

   Label

   Allows you to change the label of the results.

   Show legend:

   Allows you to show or hide the legend of the graph.

   Label:

   auto	Choose this option if you want to use the default label that has been created automatically.
   custom	Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels. For more information see How to use Custom Labels

   Bar Graph

   Data Range

   The Data Range option allows you to choose the range of data the graph will display. For line graphs, this means the data on the y-axis.

   percentage	Shows 0 to 100
   fit to data	Shows the data minimum to data maximum
   fit to data (from zero)	Shows from 0 to the data maximum
   custom	Allows you to specify the min and max
   custom fit	Allows you to specify the min and max limits, so that data outside your settings will not be shown. If all the data falls within your specified ranges then the y-axis range will fit to the data rather than your caps.

    

   Label

   Allows you to change the label of the results.

   auto	Choose this option if you want to use the default label that has been created automatically.
   custom	Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels. For more information see How to use Custom Labels

    

   Color

   Here you can enable or disable graph colour matching.

   Donut

   Display

   Size mode:

   Default	Displays the donut scaled to the height of the tile.
   Fill	Enlarges the donut to use the whole width of the tile. If you chose the fill option and show the legend, you can define the size of the legend with a slider.

    

   Show legend:

   Allows you to show or hide the legend of the graph.

    

   Color palette:

   You can choose between different colour palettes:

   General	10 different colours without specific meaning
   Priorities	5 different colours representing 5 different priority states
   Health1	3 different colours representing 3 different health states (red=unhealthy, green=healthy, grey=unknown)
   Health2	4 different colours representing 4 different health states (red=critical, orange=unhealthy, green=healthy, grey=unknown)

   Note:

   • If there are more items than colours, the colours repeat from the beginning.
   • If your using the Priorities" or "Health" palette for generic data without information about health or priority (for example, in the SQL or Web API tile), the colours get assigned in the order the results come in. You need to make sure to sort your results in the correct order to assign the correct colour to them. The order for health is from worst to best (unhealthy to healthy) and for priority from highest to lowest.
   Status Icons or Blocks

   Link options

   item link:

   Allows you to turn the graph items ( for example, the status blocks or the rows of a grid) into hyperlinks that lead you to more information about each item.

   For example, when you create a status tile for ServiceNow tickets, you can link each icon or block to the corresponding ticket. A click on the icon or block then opens the ticket in ServiceNow.

   To find out how the URL has to look like, take the URL to a specific ticket (or any other object you want to link to) as a template. Find the object ID in the URL and replace it with the value from the object ID column. You can use the mustache picker to select the object that contains the object ID.
   Example:
   The URL to a specific ticket is: https://my-ticket-system.com/ticketID-123456 The column that contains the ticket ID is called sys_id
   In this case, the URL would look like this: https://my-ticket-system.com/ticketID-{{sys_id}}

   Sort

   Sort allows you to change the order of the results displayed. You can also group them by their characteristics.

   default	By default, the sorting of the blocks or icons depends on the data source. This can be alphabetical sorting or the order in which data comes back from an API request.
   sort by	Sort by label or health state, ascending or descending
   group by	Group by label or health state, ascending or descending

    

   Blocks (only available for Block Status tiles)

   Here you can set the number of columns for the blocks, their height and the font size within the blocks.

   Label

   Allows you to change the label of the results.

   name	Choose this option if you want to use the default label that has been created automatically.
   custom	Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels. For more information see How to use Custom Labels

   Sublabel

   Allows you to add a sublabel of the results.

   custom	Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels. For more information see How to use Custom Labels
   none	By default, no sublabels are shown.

7. Click done to save the tile.

   The tile now shows data according to your settings.

Walkthrough

Configuring a Logs tile to query data

It's useful to use the Azure portal to prepare and test your queries first, see the links at the bottom of this article for further information. For this walkthrough, you are going to query Software Update status summary information.

The provided sample below assumes you have the Update Management solution enabled for your workspace.

1. In SquaredUp browse to the dashboard you wish to add the Logs tile to.

2. Click on the orange + button to add a new tile, then click on Logs > Logs (Grid)
   
   
   
   
   

3. The scope is optional, and allows you to select Azure resources to inject into the query. For this walkthrough you can leave the scope empty.

   For more information see How to scope tiles

4. Leave the timeframe as use page timeframe.
5. In the workspace section select a Log Analytics workspace from the drop down list.

6. On the Query panel you can use the saved searches button to use a query from your workspace, or you can use the following Log Analytics Query:

   UpdateSummary
   | summarize max(TimeGenerated) by Computer
   | project Computer, TimeGenerated = max_TimeGenerated
   | join (
   	UpdateSummary
   	| where TotalUpdatesMissing > 0 or RestartPending == true
   )
   on Computer, TimeGenerated
   | project-away Computer1, TimeGenerated1
   | order by TimeGenerated desc

7. The grid columns section allows you to hide and edit columns. For this walkthrough hide some columns you don't need to see by clicking the hide link next to them.
8. You can now customise the TimeGenerated column by clicking the edit link next to it's name in the grid columns panel. In the custom template box paste in {{timeago(value)}} to show a friendly time in the form Last x minutes. For more information see How to use the Grid designer when configuring tiles.
9. Leave the grid options section as it is for this walkthrough.
10. Click done.

 

Troubleshooting

"The API returned a 400 response" with message "Failed to resolve entity 'xxxxx'

Typically this indicates that a solution is missing from the queried workspace, resulting in it not containing the requested table (such as Update or UpdateSummary missing from workspaces without the Software Management solution enabled).