Query Logs with Log Analytics

Your application is running in production, users are hitting endpoints, and suddenly something breaks. You know the answer is buried somewhere in the logs, but digging through raw, unstructured text is like searching for a needle in a haystack — slow, painful, and error-prone. That's exactly the problem Azure Log Analytics solves: it gives you a powerful query language, Kusto Query Language (KQL), to turn a mountain of logs into actionable insights in seconds. In this lesson, you'll learn how to query logs with Log Analytics, from the core mental model to hands-on queries you can run today.

The Problem This Lesson Solves

When applications run in the cloud, they generate massive amounts of telemetry: request logs, error traces, performance metrics, and security events. Manually grepping through these logs is impractical because:

• Logs are distributed across multiple resources and services.
• Logs are unstructured and noisy, mixing errors with routine messages.
• Logs are ephemeral — you need to find issues while they're happening.

Without a proper querying tool, diagnosing a production incident can take hours. You might spend time scrolling through dashboards that don't show the exact log line you need, or you might miss critical patterns hidden across thousands of entries.

Azure Log Analytics solves this by centralizing logs into a single queryable store. You can filter, aggregate, and correlate data across all your Azure resources using KQL — a purpose-built language for log analysis. Whether you're debugging an API error, analyzing user behavior, or auditing security events, Log Analytics gives you a fast, reliable path from raw data to answers.

Pro tip: If you’re new to Azure, Log Analytics is part of Azure Monitor — the platform’s unified monitoring service. You might have already encountered it when setting up diagnostic settings in earlier lessons on virtual machines or App Services.

Core Concept / Mental Model

Think of Log Analytics as a supercharged search engine for your logs. Instead of typing keywords into a basic search box, you write structured queries that tell Azure exactly what to extract, compute, and return.

The heart of Log Analytics is Kusto Query Language (KQL), a read-only language designed for analyzing large datasets. KQL works in a pipeline model: each query is a series of statements separated by pipes (|). Data flows from one statement to the next, getting filtered, transformed, or aggregated at each step.

Analogy: Imagine you’re a detective at a crime scene. The logs are all the evidence scattered around. KQL is your magnifying glass and reasoning process. You start with a broad view of the scene (the table), then narrow down by time (filter), look for specific clues (search), and finally summarize what you found (aggregate).

Here’s the core building blocks of KQL:

Scope: In Log Analytics, you query against either a specific workspace (a container for logs from multiple resources) or a specific resource. The scope determines which tables are available.

How It Works Step by Step

The process of querying logs with Log Analytics involves several sequential steps:

1. Enable diagnostics — Ensure your Azure resources (like App Services, VMs, or databases) are sending logs to a Log Analytics workspace. This is usually done via Diagnostic settings in the Azure portal.

2. Open Log Analytics — In the Azure portal, navigate to your workspace or resource, and click Logs. This opens the query editor.

3. Understand the schema — Each workspace has a set of tables (e.g., AppRequests, AppTraces, AzureDiagnostics). Familiarize yourself with the relevant tables for your service.

4. Write your first query — Start simple: select a table, add filters, and project columns.

5. Run and refine — Execute the query, inspect the results, and iteratively refine to answer specific questions.

6. Save or create alerts — Once you have a useful query, you can save it, share it, or turn it into an alert rule.

Cause and effect: Without proper log collection, your query will return nothing — remember, Log Analytics can only query what it receives. So step 1 is critical.

Hands-On Walkthrough

Let’s put theory into practice. We'll use a real-world scenario: analyzing HTTP requests to a fictional web app, using the AppRequests table (available if your App Service sends logs to Log Analytics).

1. Start with a broad look

First, see what data you have. Run this simple query (type or copy into the query editor):

AppRequests
| take 10

Expected output: You'll see the first 10 rows of the AppRequests table, showing columns like TimeGenerated, Name, ResultCode, and DurationMs.

2. Filter for errors

Let’s find all requests that returned a 500 Internal Server Error in the last 24 hours:

AppRequests
| where TimeGenerated > ago(24h)
| where ResultCode == 500
| project TimeGenerated, Name, Url, ResultCode, DurationMs

Expected output: A table of 500 errors with timestamps, request name, and URL. This immediately tells you which endpoints are failing.

3. Aggregate to see trends

Now, count errors by HTTP status code over the last hour:

AppRequests
| where TimeGenerated > ago(1h)
| summarize ErrorCount = count() by ResultCode
| order by ErrorCount desc

Expected output: A list of status codes (200, 500, 404, etc.) sorted by count, giving you a quick health overview.

4. Combine multiple conditions (advanced)

Let’s find slow responses (over 3 seconds) for a specific API endpoint:

AppRequests
| where TimeGenerated > ago(6h)
| where Url contains "/api/checkout"
| where DurationMs > 3000
| project TimeGenerated, Url, DurationMs, ResultCode
| order by DurationMs desc

Expected output: A list of slow calls to your checkout API, sorted by duration. Perfect for performance debugging.

Pro tip: Always use time filters like ago() to limit the data scanned — this speeds up your queries and reduces costs.

Compare Options / When to Choose What

When it comes to querying logs in Azure, you have several options. Here’s a comparison to help you decide:

When to choose what: For answering specific questions and deep troubleshooting, go with Log Analytics. For ongoing monitoring and visualization, use Workbooks or Application Insights — but they are often built on top of Log Analytics anyway. For automation, use CLI or REST.

Variation: Some teams prefer using Azure Data Explorer directly, which shares the KQL language but is a standalone service — useful if you need to query non-Azure data.

Troubleshooting & Edge Cases

Even experienced developers hit snags. Here are common problems and fixes:

Query returns no data

• Issue: Your query is valid but returns zero rows.
• Check: Is data flowing? Go to your resource’s Diagnostic settings and confirm logs are enabled and sent to the correct workspace.
• Time filter: Extend the time range — ago(24h) might be too narrow if logs are old.
• Table name: Make sure you’re using the correct table name (e.g., AppRequests vs AzureDiagnostics). Use the schema explorer in the Log Analytics UI.

Error: "Semantic error" or "invalid column"

• Cause: Often a typo in column names or using a column that doesn't exist in the table.
• Fix: Use the schema explorer to browse available columns, or use | getschema to list columns for a table.

Query too slow

• Cause: Scanning a huge dataset without enough filtering.
• Fix: Add time filters (ago()), use where to filter early, and project only needed columns. Avoid * selections.

KQL syntax mistakes

• Common gotcha: Forgetting to separate statements with | or using == for string comparison but quotes mismatched.
• Fix: Use double quotes for strings in KQL, e.g., where ResultCode == "500" (though numbers can be without quotes).

What You Learned & What's Next

Great work! You've taken a big step toward mastering Azure Log Analytics. Let's recap what you achieved:

• You can now query logs with Log Analytics using KQL to filter, project, and aggregate data.
• You know how to apply these skills in a hands-on scenario, like finding HTTP errors or slow requests.
• You understand how Log Analytics fits into the larger Azure monitoring ecosystem and when to use it over other tools.

Your next lesson will likely cover using Application Insights for application performance monitoring, where you'll leverage your KQL skills to build powerful dashboards and set up proactive alerts.

Keep experimenting — try writing your own queries against your own resources. The more you practice, the faster you'll diagnose production issues.

Key insight: Log Analytics is your swiss-army knife for Azure logs. Master it, and you'll never fear a debugging session again.