Skip to content

Azure Log Analytics

Azure Log Analytics is a powerful tool within the Azure Monitor suite that allows you to collect, analyze, and visualize log data from your Azure resources. It helps in identifying and resolving issues, optimizing performance, and gaining insights into the operation of your cloud environment.

The Azure Log Analytics application allows you to retrieve and analyze log data from your Azure resources, providing deep insights into operational performance and security.

Options

  • Name*: Just a simple label to find it easier in the SenHub's interface.
  • Description: Description for your own usage only.
  • Vault*: Choose in the list box the appropriate vault for this resource. If you have not created it yet, see how to add a vault.
  • Group: optional — assign this instance to a group to organise it within SenHub.
  • WorkspaceId*: The unique identifier of the Azure Log Analytics workspace from which you want to retrieve data.
  • Period*: The time period over which you want to retrieve log data. The options are:
    • This month — Retrieve logs from the current month.
    • Last month — Retrieve logs from the previous month.
    • Last 3 months — Retrieve logs from the last three months.
    • Last 6 months — Retrieve logs from the last six months.
  • TimeGrain*: The granularity of the time intervals for the log data. The options are:
    • PT5M — Retrieve data at a 5-minute interval.
    • PT30M — Retrieve data at a 30-minute interval.
    • PT1H — Retrieve data at a 1-hour interval.
    • PT4H — Retrieve data at a 4-hour interval.
    • P1D — Retrieve data at a 1-day interval.
    • P2D — Retrieve data at a 2-day interval.
    • P3D — Retrieve data at a 3-day interval.
    • P7D — Retrieve data at a 7-day interval.
  • KustoQuery: The Kusto Query Language (KQL) query to execute against Azure Log Analytics. The query must* project three columns named channel, value and unit — each result row becomes one SenHub metric built from those columns. If any of these columns is missing, the connector fails.

Example output

This connector runs your KQL query against the Log Analytics workspace and returns one metric per result row; the channel names, values and units come directly from the channel, value and unit columns your Kusto query projects (the query must expose these three columns, or the sensor fails):

{
  "metrics": [
    { "channel": "ErrorCount", "value": 42, "unit": "count" },
    { "channel": "WarningCount", "value": 128, "unit": "count" },
    { "channel": "AvgDurationMs", "value": 235.4, "unit": "ms" }
  ],
  "message": "Metrics successfully retrieved.",
  "status": "OK",
  "date": 1725981405127
}