Log Analytics Workspace

A Log Analytics workspace is the central repository where Azure Monitor stores all log and performance data. It's a database you query using KQL (Kusto Query Language). Every log-based feature in Azure — alerts, workbooks, Application Insights — reads from a workspace.

What Is a Workspace and Why Do You Need One?

Think of a workspace as a big, schema-on-read database. Data arrives from many sources in different formats, and you query it all in one place. Without a workspace, your resource logs have nowhere to go — they're generated but discarded.

Key characteristics:

• Single query surface — Query logs from VMs, App Services, Functions, and custom apps together
• Access control — RBAC at workspace or table level
• Retention policies — 30 days free, configurable up to 730 days (or archive to storage)
• Regional — A workspace lives in a specific Azure region; place it near your resources to reduce latency and egress costs

How Logs Flow from Resources to Workspace

Azure Resource (e.g., App Service)
    │
    │  Diagnostic Setting (you configure this)
    │  "Send AppServiceHTTPLogs to workspace X"
    │
    ▼
Log Analytics Workspace
    │
    ├── Table: AppServiceHTTPLogs
    ├── Table: AppServiceConsoleLogs
    ├── Table: AzureActivity
    └── ... (hundreds of possible tables)

Critical point: Unlike platform metrics (which flow automatically), logs require you to create a diagnostic setting on each resource. No diagnostic setting = no logs in your workspace.

Creating a Workspace

Portal

1. Search "Log Analytics workspaces" in the portal
2. Click + Create
3. Select subscription, resource group, name, and region
4. Choose pricing tier (Per-GB is standard)
5. Click Review + Create

CLI

# Create a Log Analytics workspace
az monitor log-analytics workspace create \
  --resource-group myRG \
  --workspace-name myWorkspace \
  --location eastus \
  --retention-time 90 \
  --sku PerGB2018

# Verify it was created
az monitor log-analytics workspace show \
  --resource-group myRG \
  --workspace-name myWorkspace \
  --output table

# Get the workspace ID (needed for diagnostic settings)
az monitor log-analytics workspace show \
  --resource-group myRG \
  --workspace-name myWorkspace \
  --query id --output tsv

Configuring Diagnostic Settings

# Send App Service logs to the workspace
az monitor diagnostic-settings create \
  --name "send-to-log-analytics" \
  --resource "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Web/sites/myApp" \
  --workspace "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace" \
  --logs '[{"categoryGroup": "allLogs", "enabled": true}]' \
  --metrics '[{"category": "AllMetrics", "enabled": true}]'

# Send Activity Log (subscription-level) to workspace
az monitor diagnostic-settings subscription create \
  --name "activity-to-workspace" \
  --location eastus \
  --workspace "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace" \
  --logs '[{"category": "Administrative", "enabled": true}, {"category": "Security", "enabled": true}]'

# List existing diagnostic settings on a resource
az monitor diagnostic-settings list \
  --resource "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Web/sites/myApp"

Navigating the Logs Blade

In the portal, open your workspace → Logs. You'll see:

1. Query editor — Write KQL here
2. Tables pane (left) — Browse available tables grouped by solution
3. Time range picker (top) — Filter query results by time
4. Results grid — Shows query output in tabular form
5. Chart tab — Visualize results as bar/line/pie charts
6. Save / Share — Save queries to your workspace or share with team

Common Tables

Your First KQL Queries

// 1. Simple: See recent activity log entries
AzureActivity
| take 20

// 2. Filter: Find failed requests in the last hour
AppRequests
| where TimeGenerated > ago(1h)
| where Success == false
| project TimeGenerated, Name, ResultCode, DurationMs

// 3. Summarize: Count requests per hour over the last day
AppRequests
| where TimeGenerated > ago(24h)
| summarize RequestCount = count() by bin(TimeGenerated, 1h)
| order by TimeGenerated asc

// 4. Join: Find exceptions with their associated request
AppExceptions
| where TimeGenerated > ago(6h)
| join kind=inner (
    AppRequests | where TimeGenerated > ago(6h)
) on OperationId
| project TimeGenerated, ExceptionType = Type, RequestName = Name, ResultCode

// 5. Render: Chart error rate over time
AppRequests
| where TimeGenerated > ago(24h)
| summarize Total = count(), Errors = countif(Success == false) by bin(TimeGenerated, 1h)
| extend ErrorRate = round(100.0 * Errors / Total, 2)
| render timechart

// 6. Top offenders: Slowest endpoints
AppRequests
| where TimeGenerated > ago(24h)
| summarize AvgDuration = avg(DurationMs), P95 = percentile(DurationMs, 95) by Name
| order by P95 desc
| take 10

// 7. Audit: Who deleted resources today?
AzureActivity
| where TimeGenerated > ago(1d)
| where OperationNameValue contains "delete"
| project TimeGenerated, Caller, ResourceGroup, OperationNameValue, ActivityStatusValue

KQL Operator Reference

Saving and Sharing Queries

• Save — Click "Save" in the query editor. Choose a name and category. Saved queries appear in the "Queries" pane.
• Share as link — Click "Share" → "Link to query" to generate a URL anyone with workspace access can open.
• Export — Export results to CSV, or send to Power BI for further analysis.
• Query packs — Group related queries into a query pack for team distribution across workspaces.

Common Mistakes

• Forgetting diagnostic settings — The #1 reason beginners see empty tables. Logs don't flow without explicit configuration.
• Querying too broad a time range — Always add a where TimeGenerated > ago(...) filter to avoid scanning all data.
• Wrong table name — Table names are case-sensitive. appRequests won't work; use AppRequests.
• Creating workspaces in wrong region — Cross-region log shipping adds latency and egress costs.
• Not setting retention — Default 30 days may not meet compliance needs. Set retention at creation time.

Tips

• Use | take 10 while developing queries to avoid scanning large datasets.
• The portal's IntelliSense helps with table and column names — use it.
• Pin frequently-used queries to a dashboard for one-click access.
• Use workspace('otherWorkspace').TableName syntax to query across workspaces when needed.

Key Takeaways

• A Log Analytics workspace is where all Azure log data lives — it's the foundation for log-based monitoring.
• Logs require diagnostic settings to flow; they don't arrive automatically like metrics.
• KQL is the query language — learn where, summarize, project, and ago() first.
• Common tables include AzureActivity, AppRequests, AppExceptions, and Heartbeat.
• Start with one workspace per environment and co-locate it with your resources.
• Always filter by time range in your queries to control cost and performance.