How to use the Azure Log Analytics tile

About Azure Log Analytics tiles

The Azure Log Analytics tile allows you to query Log Analytics data from Azure Monitor(both stand-alone and in the context of resources within Azure) and display that information as part of your Dashboard Server dashboard.

The Azure Log Analytics tile queries Log Analytics using the query language (KQL).

The ability to render information as a graph is a feature of the Azure portal rather than the Log Analytics Query language itself. Graphs will only be shown if you have selected a suitable graph tile such as the Log Analytics Line Graph or Log Analytics Donut.

Note: If you want to show VM Insights data you need to enable VM Insights first, see How to show VM Insights data with the Azure Log Analytics tile.

How to configure an Azure Log Analytics tile

Add a new tile to a dashboard and choose the Logs tile.
Choose the visualization for your Azure Log Analytics tile:
Scalar
A single value such as a number of customers or incidents.
Example:
Grid
A table of data, for example incidents or tickets.
Tip: You can turn the individual rows into links in the settings. For example, if you're displaying tickets in your grid, you can link the rows to the ticket in your external ticket system.
Did you know? Since Dashboard Server 5.4 users can search the grid, and temporarily change the column size and sorting of the grid (by clicking on the column headers) without having to access the settings. They can also expand a row by clicking on the three dots at the end of each row if cells are too small to show their entire content.
Line Graph
Shows data over time, in a graph with an x-axis (time) and a y-axis. You can show several objects, such as servers, in one graph.
Example:
Bar Graph
Visualizes both a number and the resulting bar width based on the number value.
Example:
Donut
Shows the results in a donut shape.
Example:
Status Icons
Shows the state of items as icons with different colors. You can display just the icons or together with a description. You can also use a background image and drag the icons into position on the image.
Example:
Status Blocks
Shows the state of items as blocks with different colors.
Example:

Scope:

The scope is optional.

If you use a scope ensure that it contains resources monitored by Azure Log Analytics.

Scope options on dashboards

Tip: If you experience any problems with scoping tiles, you'll find FAQs and help in the article How to scope tiles.

Note: By default, results are shown across all subscriptions (unless the subscription option is chosen to specify only one or more subscriptions).

Filter by tenant	By default results are shown across all tenants. In Dashboard Server 4.7 and above a user who has access to multiple tenants will see a filter by tenant option. If you see the message "You do not have access to all of the tenants currently selected" or "Tenant ID could not be resolved" In a multi-tenant environment a user who does not have access to all tenants will see this message if they attempt to edit a scope containing tenants that they do not have access to. This may be because: One Dashboard Server admin has added a tile scoped to tenants that other Dashboard Server admins do not have permissions to. The customer/tenant is no longer serviced by this Customer Service Provider (CSP), so the tenant has been permanently removed for all Dashboard Server admins. Symptoms A tile scope shows: "You do not have access to all of the tenants currently selected. Click here to reset which will remove those tenants from the scope." Tenants the user does not have access to show as: "Tenant ID could not be resolved" Procedure The message warns users that they do not have permissions to all the tenants in the scope. If the user chooses to reset and therefore edit the scope then the tenants that they do not have access to will be removed. If saved this scope will also have those tenants removed for users who do have access to them. It is not possible for the user to edit the scope without those tenants being removed from the scope. Where a tenant has been removed permanently you may wish to reset the scope to remove the unresolvable tenants.
List	List allows you to select several individual items to show. You can add multiple items. To remove an item click the x to the right of its name. Tip: Start typing and after two characters you'll see suggestions that match the name appear. Note: It depends on the tile what happens when you select more than one item. For example, when you select two virtual machines for a Status tile, you'll see the status of those VMs individually. When you select two virtual machines for a Cost Management tile, you'll see the cost for the two VMs added together.
Resource group	Select one or more resource groups. Filter by type: Tick filter by type to only show resources of a particular type within the chosen resource group.
Subscription	Select one or more subscriptions from the dropdown box if you wish to restrict results to only one or more subscriptions. When this is not used results are shown across all subscriptions. Filter by type: Tick filter by type to only show resources of a particular type within the chosen subscription.
Tags	Select items with a particular tag. Add the tag name and the tag value you want to use to search for. If you select multiple tags, the search automatically 'ANDs' the tags which means the scope only contains items which are tagged with all the tags listed. Filter by type: Tick filter by type to only show resources of a particular type within the chosen tag(s).
Type	Scope type can be used to show all resources of a particular type, for example all databases across all subscriptions, by typing `databases` and selecting `SQL databases`.
Show hidden types	This works in the same way as the Show hidden types option in the Azure portal. Hidden types include some ancillary resources which are created/managed by Azure infrastructure. It might be useful to display these resources when cleaning up your resource groups or subscriptions.

Timeframe:
Here you determine the timeframe for the search query.
The default timeframe uses the dynamic page timeframe.
Take care when using a long timeframe, as this may pull many thousands of entries and significantly impact browser performance.
If your query doesn't specify a timeframe
Set the timeframe to use page timeframe to make the search query adapt to the dynamic page timeframe or set the timeframe to specific timeframe to choose a fixed timeframe. In this case, the search query will ignore the current page timeframe.
What is the page timeframe?
The page timeframe is the timeframe setting a dashboard or perspective is currently using. When a user changes the page timeframe, all tiles that use the page timeframe will adapt to the new timeframe. Tiles that don't use the dynamic page timeframe aren't affected and won't change.
If you are using the page timeframe,you can add a "clamping" timeframe in the query (such as where timestamp >= ago(7d)). When the page timeframe is less than 7 days it will be used, but once the page timeframe exceeds 7 days the query will enforce the max time.
If your query specifies a timeframe
If you specify a timeframe in the query (e.g. where timestamp >= ago(2h)), events must satisfy both the timeframe you set here and in the where clause in your query.
If you want to control the timeframe using only the query, set the tile timeframe to time range > all.
Workspace:
Pick the workspace you want to query from the drop-down list. For more information see Create a Log Analytics workspace in the Azure portal.
It is not possible to query multiple workspaces on a single tile, because the Azure API in use does not support cross-resource queries.

Query:

Test your query in the Log Analytics workspace in the Azure portal to be sure it returns the results expected. You can find many sample queries in this area of the portal.

Copy and paste the tested query into the Azure Log Analytics tile query box.

view in portal button:
Opens the specified workspace in the Azure portal in a new tab. From here you can test any query to be sure it returns the results expected, then save the query to the workspace, so it is ready to be accessed from Dashboard Server using the saved searches button.

saved searches button:
Will list all searches saved in the selected workspace. This is a quick and easy way to pull a query from the logs workspace into Dashboard Server, where it can be edited if required.

Configure the settings for your visualization:

Settings for Scalars

Scalar

Font size	Allows you to set the font size of the value in the tile.
Unit	Allows you to add a unit to the value displayed in the Scalar tile. For example, if your value shows a time in milliseconds, you can enter "ms" or if your value shows pageviews, you can enter "pageviews".
Value formatter	Allows you to format the value by using the mustache picker. For example, you can round the value up or down or convert it.

Color

Conditional formatting:

You can display the scalar in different colors based on conditions you defined here. For example, you can display the scalar in green when the value is below 100 and in red when it is above 100.

Click on add to configure a condition.
Click on select color.... to open the color picker. Select the color for this condition.
Enter your condition in the field next to the color. You can use the value property and manipulate it with JavaScript String and Regex APIs. When you click on the mustache picker, you'll get some examples:
- Value is greater than something, less than something, etc.
  For example: {{value < 10}} (The color you picked will be used if the value is less than 10)
- Value is present in the result
  For example: value.IndexOf('error') != -1 (The color you picked will be used if the string value "error" is present in the results)
- Value matches one of the regular expressions you defined
  For example: value.match(/healthy|good|up/) (The color you picked will be used if the string values are healthy, good, or up)

Display:

Here you decide how the color is used:

Tile background	Highlight the tile in the color you defined.
Text foreground	Display the text in the color you defined.

Link options

Allows you to turn the graph item(s) into links. You can either enter plain text to create a fixed link (URL always stays the same) or use dynamic properties to create a dynamic link.

Dynamic links make use of dynamic properties which are inserted as part of the URL. This creates a template URL that will be resolved to an actual URL based on the items properties.

For example, if you want to link to tickets in your ticket system and the format of the URL for tickets in your system is https://www.my-system/ticket-123, where 123 is the ticket ID, you can use the dynamic property that contains the ticket ID and enter the dynamic URL https://www.my-system/ticket-{{ticketID}}.

For scalars, you can only use the dynamic property value in dynamic links, which means the link changes when the value of the scalar changes. Since a scalar is just one item, it would also make sense to use a fixed link, for example the link to the website of which you are displaying the response time.
For status icon or bars and the rows of a grid, you usually want to use a dynamic link since you get multiple items or rows that represent different things. You can use any of the dynamic properties the mustache picker offers you.

Settings for Grids

Grid columns

Grid columns opens the grid designer, where you can show or hide columns, change the order of columns, edit column names or add custom columns.

How to use the Grid Designer

Grid options

Row link	Allows you to turn the graph item(s) into links. You can either enter plain text to create a fixed link (URL always stays the same) or use dynamic properties to create a dynamic link. Dynamic links make use of dynamic properties which are inserted as part of the URL. This creates a template URL that will be resolved to an actual URL based on the items properties. For example, if you want to link to tickets in your ticket system and the format of the URL for tickets in your system is `https://www.my-system/ticket-123`, where `123` is the ticket ID, you can use the dynamic property that contains the ticket ID and enter the dynamic URL `https://www.my-system/ticket-{{ticketID}}`. For scalars, you can only use the dynamic property `value` in dynamic links, which means the link changes when the value of the scalar changes. Since a scalar is just one item, it would also make sense to use a fixed link, for example the link to the website of which you are displaying the response time. For status icon or bars and the rows of a grid, you usually want to use a dynamic link since you get multiple items or rows that represent different things. You can use any of the dynamic properties the mustache picker offers you. Examples for URLs with dynamic properties for popular APIs Dynamic mustache properties and values you need to change according to your instance are highlighted in bold. ServiceNow incidents: `https://<your-instance>.service-now.com/nav_to.do?uri=%2Fincident.do%3Fsys_id%3D{{sys_id}}` PagerDuty incidents: `{{incident.html_url}}` Azure DevOps projects: `https://dev.azure.com/<your-instance>/{{name}}` Azure DevOps builds: `https://dev.azure.com/<your-instance>/_build/results?buildId={{id}}` Zendesk tickets: `https://<your-instance>.zendesk.com/agent/tickets/{{id}}` Azure Application Insights `https://portal.azure.com/#@squaredup.net/resource/{{ResourceId}}`
Show column headers	You can choose between showing or hiding the header for all columns.
Expand rows automatically	Activate this checkbox if you want the row height to expand automatically based on the row content, for example if your grid uses increased text size, images, emojis etc.
Limit number of results displayed	You can set a limit of the initial number of results displayed in the grid. If you have set a limit and there are more results to display, users will see a "show all" button below the grid.
Font size	Use the slider to adjust the font size.

Tip for column sizing: You can change the column width directly in the grid by clicking on the divider lines between columns and dragging them to the width you want. You need to show column headers (by activating the show column headers check box) to be able to change the column width.
Resizing columns while in edit mode affects how the grid looks by default when users open the dashboard. Users can temporarily change the column sizes by dragging them, but those changes only last until they leave the page.

Settings for Donuts

Sort

Sort allows you to change the order of the results displayed. You can sort by value (ascending or descending) or label (alphabetically ascending or descending).

Display

Size mode:

Default	Displays the donut scaled to the height of the tile.
Fill	Enlarges the donut to use the whole width of the tile. If you chose the fill option and show the legend, you can define the size of the legend with a slider.

Show legend:

Allows you to show or hide the legend of the graph.

Display mode:

Allows you to switch between displaying absolute values or percentages.

Color palette:

Here you can choose between different color palettes.

Note: If there are more items than colors, the colors repeat from the beginning.

Tip for displaying priorities or health states: If you want to display priorities or health states from a data source that doesn't enrich the data with information about priority or health (like the SQL tile or external APIs), use the custom color option and map the results to the correct color. This way, you can make sure that healthy or low priority results are displayed in green, unhealthy or high priority results are displayed in red, etc. If you use the color palettes Priorities, Health1, or Health2 the colors get assigned depending on how the results are sorted, which doesn't guarantee that the colors make sense for the priority or state they represent.

General	10 different colors without specific meaning
Priorities	5 different colors representing 5 different priority states
Health1	3 different colors representing 3 different health states (red=unhealthy, green=healthy, gray=unknown)
Health2	4 different colors representing 4 different health states (red=critical, orange=unhealthy, green=healthy, gray=unknown)
Pastel	10 different pastel colors without specific meaning
Blue	4 different shades of blue from dark to light
Orange	4 different shades of orange from dark to light
Green	4 different shades of green from dark to light
Pink	4 different shades of pink from dark to light
Custom	Here you can choose colors and map them to a value. Click on Select color... to select a color and enter the name of the value that you want to display in that color. Make sure you spell the value's name correctly (case-sensitive), otherwise the color won't be assigned to it. Note if your color mapping doesn't work (color stays gray) If you entered the value's name correctly (case-sensitive) and your mapping still doesn't work, check if the mapping value contains leading or trailing spaces. Try to enter the value with and without those spaces. Alternatively, you can remove spaces from the mustache expression and enter the values without spaces. Example: Mustache expression with leading and trailing spaces in the values: `{{#if Status == "1" }} Healthy {{elseif Status == "2" }} Down {{elseif Status == "3" }} Warning {{/if}}` Mustache expression without spaces in the values: `{{#if Status == "1" }}Healthy{{elseif Status == "2" }}Down{{elseif Status == "3" }}Warning{{/if}}`

Settings for Status Icons

Link options

item link:

Allows you to turn the graph item(s) into links. You can either enter plain text to create a fixed link (URL always stays the same) or use dynamic properties to create a dynamic link.

Dynamic links make use of dynamic properties which are inserted as part of the URL. This creates a template URL that will be resolved to an actual URL based on the items properties.

For scalars, you can only use the dynamic property value in dynamic links, which means the link changes when the value of the scalar changes. Since a scalar is just one item, it would also make sense to use a fixed link, for example the link to the website of which you are displaying the response time.
For status icon or bars and the rows of a grid, you usually want to use a dynamic link since you get multiple items or rows that represent different things. You can use any of the dynamic properties the mustache picker offers you.

Label

Allows you to change the label of the results.

name

Choose this option if you want to use the default label that has been created automatically.

custom

Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels.

For more information see How to use Custom Labels

Sublabel

Allows you to add a sublabel of the results.

custom

Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels.

For more information see How to use Custom Labels

none By default, no sublabels are shown.

Sort

Sort allows you to change the order of the results displayed. You can also group them by their characteristics.

default	By default, the sorting of the blocks or icons depends on the data source. This can be alphabetical sorting or the order in which data comes back from an API request.
sort by	Sort by label or tenant, ascending or descending
group by	Group by label or tenant, ascending or descending

Image

Here you can choose one of the provided images or upload your own.
Tip: If you want a different selection of maps, you can download more at https://freevectormaps.com/

Supported image formats: png, jpg, jpeg, gif, tif, tiff. svg, bmp
Tip: SVG images resize best since they are vector images.

File size limit: 10MB

Image size: Images fill the size of the tile, which means you can resize the image by adjusting the tile's size. The size of the tile also depends on the screen the dashboard is being viewed on.

Icons

Here you can customize the icons on the image:

You can change the size of the icons with the slider
You can change the shape of the icons (square or circle)
You can drag the icons on the image into position

Display styles for Status icons

This setting is not done in a panel, you can change the display style even after you finished configuring the tile.

You can use toggle zoom button at the top right of the tile to change between the different ways Status icons can be displayed.

One long list
Column list
Icons only

Settings for Status Blocks

Link options

item link:

Allows you to turn the graph item(s) into links. You can either enter plain text to create a fixed link (URL always stays the same) or use dynamic properties to create a dynamic link.

Dynamic links make use of dynamic properties which are inserted as part of the URL. This creates a template URL that will be resolved to an actual URL based on the items properties.

For scalars, you can only use the dynamic property value in dynamic links, which means the link changes when the value of the scalar changes. Since a scalar is just one item, it would also make sense to use a fixed link, for example the link to the website of which you are displaying the response time.
For status icon or bars and the rows of a grid, you usually want to use a dynamic link since you get multiple items or rows that represent different things. You can use any of the dynamic properties the mustache picker offers you.

Label

Allows you to change the label of the results.

name

Choose this option if you want to use the default label that has been created automatically.

custom

Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels.

For more information see How to use Custom Labels

Sublabel

Allows you to add a sublabel of the results.

custom

Here you can change the label to a custom label. You can use static text and dynamic properties. Use the mustache picker to select dynamic properties from the response data to use them as labels.

For more information see How to use Custom Labels

none By default, no sublabels are shown.

Sort

Sort allows you to change the order of the results displayed. You can also group them by their characteristics.

default	By default, the sorting of the blocks or icons depends on the data source. This can be alphabetical sorting or the order in which data comes back from an API request.
sort by	Sort by label or tenant, ascending or descending
group by	Group by label or tenant, ascending or descending

Blocks

Here you can set the number of columns for the blocks, their height and the font size within the blocks.

Click done to save the tile.
The tile now shows data according to your settings.

Walkthrough

Query update information in a Grid visualization

For this walkthrough, you are going to query Software Update status summary information. The provided sample below assumes you have the Update Management solution enabled for your workspace.

In Dashboard Server browse to the dashboard you wish to add the Azure Log Analytics tile to.
Click on the orange + button to add a new tile, then click on Logs > Logs(Grid)
The scope is optional, and allows you to select Azure resources to inject into the query. For this walkthrough you can leave the scope empty.
For more information see How to scope tiles.
Leave the timeframe as use page timeframe.
In the workspace section select a Log Analytics workspace from the drop down list.

On the Query panel you can use the saved searches button to use a query from your workspace, or you can use the following Log Analytics Query:

Copy

UpdateSummary
| summarize max(TimeGenerated) by Computer
| project Computer, TimeGenerated = max_TimeGenerated
| join (
    UpdateSummary
    | where TotalUpdatesMissing > 0 or RestartPending == true
)
on Computer, TimeGenerated
| project-away Computer1, TimeGenerated1
| order by TimeGenerated desc

The grid columns section allows you to hide and edit columns. For this walkthrough hide some columns you don't need to see by clicking the hide link next to them.
You can customize the appearance of columns by clicking the edit link next to it's name in the grid columns panel and then specifying a custom template. For example, locate the TimeGenerated column and set the template to {{timeago(value)}} to show a friendly time in the form Last x minutes rather than the specific time. For more information see How to use the Grid Designer.
Leave the grid options section as it is for this walkthrough.
Click done.

How to show VM Insights data with the Azure Log Analytics tile

VM Insights allows you to collect additional metrics called guest level metrics from your virtual machines (VMs).

You need to enable VM Insights in your Azure portal for each VM you want to monitor before you can show VM Insights data with the Azure Log Analytics tile.

You can find all information about enabling VM Insights in the Azure documentation.

Where to find KQL queries for showing VM Insights data

You can find useful queries by viewing VM Insights in your Azure portal. You'll see the underlying queries of Performance graphs when you edit them in Azure and can copy them from there. The Dependency Map shown in the Azure portal cannot currently be shown in Dashboard Server.

VM Insights query example: Show the average Processor \ Utilization Percentage

Copy

InsightsMetrics
| where Namespace == "Processor"
| where Name == "UtilizationPercentage"
| summarize avg(Val) by Computer, bin(TimeGenerated, 5m)

VM Insights query example: Show available memory of a VM on a perspective

For perspectives, you need to pull in the VM that is the focus of the perspective with {{scope[0].name}}:

Copy

InsightsMetrics
| where Computer startswith "{{scope[0].name}}"
| where Namespace == "Memory"
| where Name == "AvailableMB"
| summarize avg(Val) by Computer, bin(TimeGenerated, 5m)

Troubleshooting

"The API returned a 400 response" with message "Failed to resolve entity 'xxxxx'

Typically this indicates that a solution is missing from the queried workspace, resulting in it not containing the requested table (such as Update or UpdateSummary missing from workspaces without the Software Management solution enabled).

AZURE LIVE KB.10.log-255910939.zip
7 KB Download

`Healthy`	green
`Warning`	yellow
`Critical`	red
`Unknown`	gray

percentage	Shows 0 to 100
fit to data	Shows the data minimum to data maximum
fit to data (from zero)	Shows from 0 to the data maximum
custom	Allows you to specify the min and max
custom fit	Allows you to specify the min and max limits, so that data outside your settings will not be shown. If all the data falls within your specified ranges then the y-axis range will fit to the data rather than your caps.

percentage	Shows 0 to 100
fit to data	Shows the data minimum to data maximum
fit to data (from zero)	Shows from 0 to the data maximum
custom	Allows you to specify the min and max
custom fit	Allows you to specify the min and max limits, so that data outside your settings will not be shown. If all the data falls within your specified ranges then the y-axis range will fit to the data rather than your caps.