Skip to content

Commit 4406e45

Browse files
scottaddiescottaddie
authored
Add resource-centric logs query example to README (Azure#36247)
* Add resource-centric logs query example to README * Add instructions for locating resource ID * Update numbering
1 parent 7aba53b commit 4406e45

File tree

3 files changed

+89
-81
lines changed

3 files changed

+89
-81
lines changed

‎sdk/monitor/Azure.Monitor.Query/README.md‎

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ The Azure Monitor Query client library is used to execute read-only queries agai
2121

2222
- An [Azure subscription][azure_subscription]
2323
- A [TokenCredential](https://learn.microsoft.com/dotnet/api/azure.core.tokencredential?view=azure-dotnet) implementation, such as an [Azure Identity library credential type](https://learn.microsoft.com/dotnet/api/overview/azure/Identity-readme#credential-classes).
24-
- To query Logs, you need an [Azure Log Analytics workspace][azure_monitor_create_using_portal].
24+
- To query Logs, you need one of the following things:
25+
- An [Azure Log Analytics workspace][azure_monitor_create_using_portal]
26+
- An Azure resource of any kind (Storage Account, Key Vault, Cosmos DB, etc.)
2527
- To query Metrics, you need an Azure resource of any kind (Storage Account, Key Vault, Cosmos DB, etc.).
2628

2729
### Install the package
@@ -104,21 +106,53 @@ All client instance methods are thread-safe and independent of each other ([guid
104106

105107
### Logs query
106108

107-
You can query logs using the `LogsQueryClient.QueryWorkspaceAsync` method. The result is returned as a table with a collection of rows:
109+
You can query logs by workspace ID or resource ID. The result is returned as a table with a collection of rows.
110+
111+
**Workspace-centric logs query**
112+
113+
To query by workspace ID, use the [LogsQueryClient.QueryWorkspaceAsync](https://learn.microsoft.com/dotnet/api/azure.monitor.query.logsqueryclient.queryworkspaceasync) method:
108114

109115
```C# Snippet:QueryLogsAsTable
110116
string workspaceId = "<workspace_id>";
111117
var client = new LogsQueryClient(new DefaultAzureCredential());
112-
Response<LogsQueryResult> response = await client.QueryWorkspaceAsync(
118+
119+
Response<LogsQueryResult> result = await client.QueryWorkspaceAsync(
113120
workspaceId,
114121
"AzureActivity | top 10 by TimeGenerated",
115122
new QueryTimeRange(TimeSpan.FromDays(1)));
116123

117-
LogsTable table = response.Value.Table;
124+
LogsTable table = result.Value.Table;
118125

119126
foreach (var row in table.Rows)
120127
{
121-
Console.WriteLine(row["OperationName"] + " " + row["ResourceGroup"]);
128+
Console.WriteLine($"{row["OperationName"]} {row["ResourceGroup"]}");
129+
}
130+
```
131+
132+
**Resource-centric logs query**
133+
134+
To query by resource ID, use the [LogsQueryClient.QueryResourceAsync](https://learn.microsoft.com/dotnet/api/azure.monitor.query.logsqueryclient.queryresourceasync) method.
135+
136+
To find the resource ID:
137+
138+
1. Navigate to your resource's page in the Azure portal.
139+
1. From the **Overview** blade, select the **JSON View** link.
140+
1. In the resulting JSON, copy the value of the `id` property.
141+
142+
```C# Snippet:QueryResource
143+
string resourceId = "/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/<resource_provider>/<resource>";
144+
var client = new LogsQueryClient(new DefaultAzureCredential());
145+
146+
Response<LogsQueryResult> result = await client.QueryResourceAsync(
147+
new ResourceIdentifier(resourceId),
148+
"AzureActivity | top 10 by TimeGenerated",
149+
new QueryTimeRange(TimeSpan.FromDays(1)));
150+
151+
LogsTable table = result.Value.Table;
152+
153+
foreach (LogsTableRow row in table.Rows)
154+
{
155+
Console.WriteLine($"{row["OperationName"]} {row["ResourceGroup"]}");
122156
}
123157
```
124158

‎sdk/monitor/Azure.Monitor.Query/src/LogsQueryClient.cs‎

Lines changed: 32 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -322,25 +322,19 @@ public virtual async Task<Response<LogsBatchQueryResultCollection>> QueryBatchAs
322322
/// Returns all the Azure Monitor logs matching the given query for an Azure resource.
323323
/// <example snippet="Snippet:QueryResource">
324324
/// <code language="csharp">
325+
/// string resourceId = &quot;/subscriptions/&lt;subscription_id&gt;/resourceGroups/&lt;resource_group_name&gt;/providers/&lt;resource_provider&gt;/&lt;resource&gt;&quot;;
325326
/// var client = new LogsQueryClient(new DefaultAzureCredential());
326327
///
327-
/// var results = await client.QueryResourceAsync(new ResourceIdentifier(TestEnvironment.StorageAccountId),
328-
/// &quot;search *&quot;,
329-
/// new QueryTimeRange(TimeSpan.FromDays(5)));
330-
///
331-
/// var resultTable = results.Value.Table;
328+
/// Response&lt;LogsQueryResult&gt; result = await client.QueryResourceAsync(
329+
/// new ResourceIdentifier(resourceId),
330+
/// &quot;AzureActivity | top 10 by TimeGenerated&quot;,
331+
/// new QueryTimeRange(TimeSpan.FromDays(1)));
332332
///
333-
/// foreach (LogsTableRow rows in resultTable.Rows)
334-
/// {
335-
/// foreach (var row in rows)
336-
/// {
337-
/// Console.WriteLine(row);
338-
/// }
339-
/// }
333+
/// LogsTable table = result.Value.Table;
340334
///
341-
/// foreach (LogsTableColumn columns in resultTable.Columns)
335+
/// foreach (LogsTableRow row in table.Rows)
342336
/// {
343-
/// Console.WriteLine(&quot;Name: &quot; + columns.Name + &quot; Type: &quot; + columns.Type);
337+
/// Console.WriteLine($&quot;{row[&quot;OperationName&quot;]} {row[&quot;ResourceGroup&quot;]}&quot;);
344338
/// }
345339
/// </code>
346340
/// </example>
@@ -362,25 +356,19 @@ public virtual Response<IReadOnlyList<T>> QueryResource<T>(ResourceIdentifier re
362356
/// Returns all the Azure Monitor logs matching the given query for an Azure resource.
363357
/// <example snippet="Snippet:QueryResource">
364358
/// <code language="csharp">
359+
/// string resourceId = &quot;/subscriptions/&lt;subscription_id&gt;/resourceGroups/&lt;resource_group_name&gt;/providers/&lt;resource_provider&gt;/&lt;resource&gt;&quot;;
365360
/// var client = new LogsQueryClient(new DefaultAzureCredential());
366361
///
367-
/// var results = await client.QueryResourceAsync(new ResourceIdentifier(TestEnvironment.StorageAccountId),
368-
/// &quot;search *&quot;,
369-
/// new QueryTimeRange(TimeSpan.FromDays(5)));
370-
///
371-
/// var resultTable = results.Value.Table;
362+
/// Response&lt;LogsQueryResult&gt; result = await client.QueryResourceAsync(
363+
/// new ResourceIdentifier(resourceId),
364+
/// &quot;AzureActivity | top 10 by TimeGenerated&quot;,
365+
/// new QueryTimeRange(TimeSpan.FromDays(1)));
372366
///
373-
/// foreach (LogsTableRow rows in resultTable.Rows)
374-
/// {
375-
/// foreach (var row in rows)
376-
/// {
377-
/// Console.WriteLine(row);
378-
/// }
379-
/// }
367+
/// LogsTable table = result.Value.Table;
380368
///
381-
/// foreach (LogsTableColumn columns in resultTable.Columns)
369+
/// foreach (LogsTableRow row in table.Rows)
382370
/// {
383-
/// Console.WriteLine(&quot;Name: &quot; + columns.Name + &quot; Type: &quot; + columns.Type);
371+
/// Console.WriteLine($&quot;{row[&quot;OperationName&quot;]} {row[&quot;ResourceGroup&quot;]}&quot;);
384372
/// }
385373
/// </code>
386374
/// </example>
@@ -402,25 +390,19 @@ public virtual async Task<Response<IReadOnlyList<T>>> QueryResourceAsync<T>(Reso
402390
/// Returns all the Azure Monitor logs matching the given query for an Azure resource.
403391
/// <example snippet="Snippet:QueryResource">
404392
/// <code language="csharp">
393+
/// string resourceId = &quot;/subscriptions/&lt;subscription_id&gt;/resourceGroups/&lt;resource_group_name&gt;/providers/&lt;resource_provider&gt;/&lt;resource&gt;&quot;;
405394
/// var client = new LogsQueryClient(new DefaultAzureCredential());
406395
///
407-
/// var results = await client.QueryResourceAsync(new ResourceIdentifier(TestEnvironment.StorageAccountId),
408-
/// &quot;search *&quot;,
409-
/// new QueryTimeRange(TimeSpan.FromDays(5)));
410-
///
411-
/// var resultTable = results.Value.Table;
396+
/// Response&lt;LogsQueryResult&gt; result = await client.QueryResourceAsync(
397+
/// new ResourceIdentifier(resourceId),
398+
/// &quot;AzureActivity | top 10 by TimeGenerated&quot;,
399+
/// new QueryTimeRange(TimeSpan.FromDays(1)));
412400
///
413-
/// foreach (LogsTableRow rows in resultTable.Rows)
414-
/// {
415-
/// foreach (var row in rows)
416-
/// {
417-
/// Console.WriteLine(row);
418-
/// }
419-
/// }
401+
/// LogsTable table = result.Value.Table;
420402
///
421-
/// foreach (LogsTableColumn columns in resultTable.Columns)
403+
/// foreach (LogsTableRow row in table.Rows)
422404
/// {
423-
/// Console.WriteLine(&quot;Name: &quot; + columns.Name + &quot; Type: &quot; + columns.Type);
405+
/// Console.WriteLine($&quot;{row[&quot;OperationName&quot;]} {row[&quot;ResourceGroup&quot;]}&quot;);
424406
/// }
425407
/// </code>
426408
/// </example>
@@ -452,25 +434,19 @@ public virtual Response<LogsQueryResult> QueryResource(ResourceIdentifier resour
452434
/// Returns all the Azure Monitor logs matching the given query for an Azure resource.
453435
/// <example snippet="Snippet:QueryResource">
454436
/// <code language="csharp">
437+
/// string resourceId = &quot;/subscriptions/&lt;subscription_id&gt;/resourceGroups/&lt;resource_group_name&gt;/providers/&lt;resource_provider&gt;/&lt;resource&gt;&quot;;
455438
/// var client = new LogsQueryClient(new DefaultAzureCredential());
456439
///
457-
/// var results = await client.QueryResourceAsync(new ResourceIdentifier(TestEnvironment.StorageAccountId),
458-
/// &quot;search *&quot;,
459-
/// new QueryTimeRange(TimeSpan.FromDays(5)));
460-
///
461-
/// var resultTable = results.Value.Table;
440+
/// Response&lt;LogsQueryResult&gt; result = await client.QueryResourceAsync(
441+
/// new ResourceIdentifier(resourceId),
442+
/// &quot;AzureActivity | top 10 by TimeGenerated&quot;,
443+
/// new QueryTimeRange(TimeSpan.FromDays(1)));
462444
///
463-
/// foreach (LogsTableRow rows in resultTable.Rows)
464-
/// {
465-
/// foreach (var row in rows)
466-
/// {
467-
/// Console.WriteLine(row);
468-
/// }
469-
/// }
445+
/// LogsTable table = result.Value.Table;
470446
///
471-
/// foreach (LogsTableColumn columns in resultTable.Columns)
447+
/// foreach (LogsTableRow row in table.Rows)
472448
/// {
473-
/// Console.WriteLine(&quot;Name: &quot; + columns.Name + &quot; Type: &quot; + columns.Type);
449+
/// Console.WriteLine($&quot;{row[&quot;OperationName&quot;]} {row[&quot;ResourceGroup&quot;]}&quot;);
474450
/// }
475451
/// </code>
476452
/// </example>

‎sdk/monitor/Azure.Monitor.Query/tests/LogsQueryClientSamples.cs‎

Lines changed: 18 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public async Task QueryLogsWithVisualization()
7979

8080
[Test]
8181
[Explicit]
82-
public async Task QueryLogsAsTable()
82+
public async Task QueryLogsByWorkspaceAsTable()
8383
{
8484
#region Snippet:QueryLogsAsTable
8585
#if SNIPPET
@@ -90,18 +90,18 @@ public async Task QueryLogsAsTable()
9090
#region Snippet:CreateLogsClient
9191
var client = new LogsQueryClient(new DefaultAzureCredential());
9292
#endregion
93-
Response<LogsQueryResult> response = await client.QueryWorkspaceAsync(
93+
94+
Response<LogsQueryResult> result = await client.QueryWorkspaceAsync(
9495
workspaceId,
9596
"AzureActivity | top 10 by TimeGenerated",
9697
new QueryTimeRange(TimeSpan.FromDays(1)));
9798

98-
LogsTable table = response.Value.Table;
99+
LogsTable table = result.Value.Table;
99100

100101
foreach (var row in table.Rows)
101102
{
102-
Console.WriteLine(row["OperationName"] + " " + row["ResourceGroup"]);
103+
Console.WriteLine($"{row["OperationName"]} {row["ResourceGroup"]}");
103104
}
104-
105105
#endregion
106106
}
107107

@@ -382,28 +382,26 @@ public async Task QueryLogsWithPartialSuccess()
382382

383383
[Test]
384384
[Explicit]
385-
public async Task QueryResource()
385+
public async Task QueryLogsByResourceAsTable()
386386
{
387387
#region Snippet:QueryResource
388+
#if SNIPPET
389+
string resourceId = "/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/<resource_provider>/<resource>";
390+
#else
391+
string resourceId = TestEnvironment.StorageAccountId;
392+
#endif
388393
var client = new LogsQueryClient(new DefaultAzureCredential());
389394

390-
var results = await client.QueryResourceAsync(new ResourceIdentifier(TestEnvironment.StorageAccountId),
391-
"search *",
392-
new QueryTimeRange(TimeSpan.FromDays(5)));
393-
394-
var resultTable = results.Value.Table;
395+
Response<LogsQueryResult> result = await client.QueryResourceAsync(
396+
new ResourceIdentifier(resourceId),
397+
"AzureActivity | top 10 by TimeGenerated",
398+
new QueryTimeRange(TimeSpan.FromDays(1)));
395399

396-
foreach (LogsTableRow rows in resultTable.Rows)
397-
{
398-
foreach (var row in rows)
399-
{
400-
Console.WriteLine(row);
401-
}
402-
}
400+
LogsTable table = result.Value.Table;
403401

404-
foreach (LogsTableColumn columns in resultTable.Columns)
402+
foreach (LogsTableRow row in table.Rows)
405403
{
406-
Console.WriteLine("Name: " + columns.Name + " Type: " + columns.Type);
404+
Console.WriteLine($"{row["OperationName"]} {row["ResourceGroup"]}");
407405
}
408406
#endregion
409407
}

0 commit comments

Comments
 (0)