What is Log Analytics Workspace in Azure?

A Log Analytics Workspace is a centralized location in Azure Monitor used to collect, store, query, and analyze log data from Azure resources, applications, and virtual machines.

It allows administrators and developers to investigate errors, monitor resource activities, and troubleshoot application issues using Kusto Query Language (KQL).

1. Simple Example

Suppose you have the following Azure resources:

• Azure Virtual Machine

• Azure App Service

• Azure SQL Database

• Azure Storage Account

Instead of checking logs individually, you can send supported logs from these resources to a single Log Analytics Workspace.

        Azure Virtual Machine
                 |
        Azure App Service
                 |
        Azure SQL Database
                 |
        Azure Storage Account
                 |
                 v
       Diagnostic Settings /
        Monitoring Agents
                 |
                 v
       Log Analytics Workspace
                 |
                 v
          Query Using KQL
                 |
         +-------+-------+
         |               |
         v               v
   Troubleshooting    Monitoring
         |               |
         v               v
     Find Errors       Alerts

Example: If your App Service fails to connect to Azure SQL Database, you can query the collected application and database logs to investigate the issue.

2. What Does Log Analytics Workspace Store?

A workspace organizes log records into tables.

Important: Tables contain data only when the relevant collection or export has been configured. Some Azure services use resource-specific tables instead of AzureDiagnostics.

3. How to Create a Log Analytics Workspace in Azure Portal

Step 1: Open Azure Portal

1. Sign in to Azure Portal.

2. Search for Log Analytics workspaces.

3. Click Create.

Step 2: Configure Workspace

Click Review + Create → Create.

Step 3: Open Workspace

After deployment:

1. Open the newly created workspace.

2. Select Logs.

3. You can now execute KQL queries against data collected in the workspace.

Creating a workspace does not automatically configure every Azure resource to send logs to it.

4. How to Connect Azure App Service to Log Analytics Workspace

1. Open Azure Portal → App Services.

2. Select your App Service.

3. Under Monitoring, select Diagnostic settings.

4. Click Add diagnostic setting.

5. Enter a name, such as appservice-logs.

6. Select the required log categories, such as:

   • AppServiceHTTPLogs

   • AppServiceConsoleLogs

   • AppServiceAppLogs

7. Enable Send to Log Analytics workspace.

8. Select your subscription and workspace.

9. Click Save.

Your App Service will begin sending the selected logs to the workspace as they are generated, subject to supported logging configuration.

5. Query Logs Using KQL

KQL stands for Kusto Query Language.

It is used to search, filter, summarize, and analyze log data.

Example 1: Get the latest 10 application requests

AppRequests
| order by TimeGenerated desc
| take 10

Example 2: Find failed application requests

AppRequests
| where Success == false
| project TimeGenerated,
          Name,
          ResultCode,
          DurationMs
| order by TimeGenerated desc

Example 3: Find application exceptions

AppExceptions
| order by TimeGenerated desc
| take 10

These App* tables are typically populated through workspace-based Application Insights, not merely by enabling App Service diagnostic settings.

6. Log Analytics Workspace vs Application Insights

7. Log Analytics Workspace vs Azure Monitor

8. Is Log Analytics Workspace Free?

Creating a Log Analytics Workspace does not normally incur a charge by itself.

Charges can apply for:

• Log data ingestion

• Log retention beyond included periods

• Certain query or data processing features

• Additional monitoring services

Pricing depends on the workspace configuration, table plan, and data volume.

9. Interview Quick Revision

Q1. What is Log Analytics Workspace in Azure?

A Log Analytics Workspace is a centralized Azure Monitor resource used to collect, store, and analyze logs from Azure resources and applications using KQL.

Q2. What is KQL?

Kusto Query Language is a query language used to retrieve, filter, aggregate, and analyze data stored in Azure Monitor Logs.

Q3. Can multiple Azure resources use the same workspace?

Yes. Multiple Azure resources can send their logs to the same Log Analytics Workspace, subject to supported configurations and access permissions.

Q4. Is Log Analytics Workspace mandatory for Azure Monitor?

No. Azure Monitor platform metrics and the default Activity Log can be used without a Log Analytics Workspace. However, a workspace is required for storing and querying Azure Monitor Logs.

Q5. What is the difference between Log Analytics and Application Insights?

Log Analytics is used to query and analyze log data, while Application Insights focuses on application performance, failures, requests, dependencies, and distributed tracing.

Easy Way to Remember

• Azure Monitor: Monitors Azure resources.

• Metrics: Measures performance.

• Activity Log: Records Azure management operations.

• Diagnostic Settings: Routes supported logs to destinations.

• Log Analytics Workspace: Stores and organizes collected logs.

• KQL: Queries and analyzes logs.

• Application Insights: Monitors application performance and failures.

Real-time example: Your ASP.NET Core Web API returns HTTP 500 errors. Application Insights captures failed requests and exceptions, stores the telemetry in its connected Log Analytics Workspace, and allows you to investigate the failures using KQL.

 

Azure Practical Lab: Send Metrics and Activity Logs to Log Analytics Workspace

In this exercise, we'll configure Azure Monitor Diagnostic Settings to send Azure App Service metrics and Azure subscription Activity Logs to a Log Analytics Workspace.

We will also verify the collected data using Kusto Query Language (KQL).

1. Understand the Architecture

             Azure Subscription
                     |
          +----------+----------+
          |                     |
          v                     v
   Azure App Service      Azure Activity Log
          |                     |
          v                     |
   Platform Metrics             |
          |                     |
          v                     v
      Diagnostic Settings
          |                     |
          +----------+----------+
                     |
                     v
          Log Analytics Workspace
                     |
                     v
               KQL Queries
                     |
              +------+------+
              |             |
              v             v
           Analysis       Alerts

Important: Metrics and Activity Logs are different data sources. Their Diagnostic Settings are configured separately.

2. Create a Log Analytics Workspace

Step 1: Sign in to Azure Portal.

Step 2: Search for Log Analytics workspaces.

Step 3: Click Create.

Step 4: Enter the following details:

Setting	Example
Subscription	Your Azure subscription
Resource Group	rg-monitoring-demo
Workspace Name	law-monitoring-demo
Region	Central India

Step 5: Click Review + Create → Create.

Step 6: Once deployment completes, click Go to resource.

Your workspace is ready to receive data.

3. Send Azure Activity Logs to Log Analytics Workspace

Activity Logs are collected automatically at the subscription level, but you must configure their export to the workspace.

Step 1: In Azure Portal, search for Monitor.

Step 2: Select Activity log.

Step 3: Choose your subscription.

Step 4: Click Export Activity Logs (or Diagnostic settings, depending on the portal view).

Step 5: Click Add diagnostic setting.

Step 6: Enter the following:

Setting	Value
Diagnostic setting name	activitylogs-to-law
Destination	Send to Log Analytics workspace
Subscription	Your subscription
Workspace	law-monitoring-demo

Step 7: Select the log categories you want to export.

For a practical exercise, select:

• Administrative

• Security

• ServiceHealth

• Alert

• Recommendation

• Policy

• Autoscale

• ResourceHealth

Step 8: Click Save.

Activity Logs generated after the configuration is saved will be sent to the workspace. Export is not a historical backfill.

4. Verify Activity Logs Using KQL

Open your Log Analytics Workspace and select Logs.

Execute:

AzureActivity
| order by TimeGenerated desc
| take 10

To see resource modification operations:

AzureActivity
| where OperationNameValue contains "write"
| project TimeGenerated,
          OperationNameValue,
          Caller,
          ResourceGroup,
          ActivityStatusValue
| order by TimeGenerated desc

If the table is empty, perform a safe management operation, such as updating a test resource's tag, and allow time for ingestion.

5. Send Azure App Service Metrics to Log Analytics Workspace

Now configure metric export separately from Activity Logs.

Step 1: Search for App Services in Azure Portal.

Step 2: Select your App Service.

Step 3: Under Monitoring, select Diagnostic settings.

Step 4: Click Add diagnostic setting.

Step 5: Configure:

Setting	Value
Diagnostic setting name	appservice-metrics-to-law
Category type	Metrics
Metric category	AllMetrics
Destination	Send to Log Analytics workspace
Workspace	law-monitoring-demo

Step 6: Click Save.

If the AllMetrics category is available, Azure exports supported platform metrics to the workspace. Not every metric is exportable through Diagnostic Settings.

Microsoft Learn

+1

 

6. Verify Exported Metrics Using KQL

Open Log Analytics Workspace → Logs.

Execute:

AzureMetrics
| order by TimeGenerated desc
| take 10

To display average metric values over five-minute intervals:

AzureMetrics
| where TimeGenerated > ago(1h)
| summarize AvgValue = avg(Average)
    by MetricName, bin(TimeGenerated, 5m)
| order by TimeGenerated desc

To identify which metrics are arriving:

AzureMetrics
| summarize Records = count() by MetricName
| order by Records desc

7. Alternative: Export Metrics Using Data Collection Rules (DCR)

Azure Monitor also supports platform metrics export using Data Collection Rules for supported resource types.

This approach offers advantages over Diagnostic Settings, including exporting selected metrics while preserving dimensions.

To configure it:

1. Open Azure Monitor.

2. Navigate to Data Collection Rules.

3. Create a rule for platform telemetry/metrics export, using the available portal workflow.

4. Select supported Azure resources.

5. Choose the metrics to export.

6. Configure the destination as your Log Analytics Workspace.

7. Create the rule.

DCR-exported metrics are stored in the AzureMetricsV2 table rather than AzureMetrics.

Verify using:

AzureMetricsV2
| take 10

Important: DCR-based platform metric export has resource and regional support requirements. Check whether your App Service resource is supported before choosing this method. Avoid enabling both export methods for the same metrics because that can create duplicate data.

Microsoft Learn

 

8. Verify Both Data Sources

After configuring both exports, your workspace should contain the following tables once data arrives.

Source	Export Method	KQL Table
Azure Activity Log	Subscription Diagnostic Settings	AzureActivity
App Service Metrics	Resource Diagnostic Settings	AzureMetrics
Supported platform metrics	Platform telemetry DCR	AzureMetricsV2

You can check the volume of data arriving in the last 24 hours:

union isfuzzy=true
    (AzureActivity | summarize Count=count() | extend Source="Activity"),
    (AzureMetrics | summarize Count=count() | extend Source="Metrics"),
    (AzureMetricsV2 | summarize Count=count() | extend Source="MetricsV2")
| project Source, Count

If a table has not been created yet, queries against it may fail or return partial results. You can first run each table query separately.

9. Common Issues and Troubleshooting

Issue	Possible Cause / Solution
AzureActivity table is empty	Check subscription-level Diagnostic Settings and generate a new management operation
AzureMetrics table is empty	Verify AllMetrics is enabled and the metric supports export
No logs immediately	Allow time for data ingestion; Activity Log export can take around 30 minutes to begin
Missing metric dimensions	Diagnostic Settings flatten multidimensional metrics; use DCR export where supported
Unexpected costs	Review ingestion volume and workspace retention settings

Microsoft Learn

+1

10. Final Verification Checklist

Practical Lab Completion

0 / 6

 

Log Analytics Workspace created

Activity Log export enabled at subscription level

App Service AllMetrics export configured

AzureActivity query returns records

AzureMetrics query returns records

Workspace ingestion and retention costs reviewed

Interview Quick Revision

Q: How do you send Azure Metrics and Activity Logs to a Log Analytics Workspace?

Azure Monitor Diagnostic Settings can export supported platform metrics and subscription Activity Logs to a Log Analytics Workspace. Activity Logs are configured at the subscription level, while metrics are configured at the resource level.

Key Points:

• Activity Logs are stored in AzureActivity.

• Metrics exported through Diagnostic Settings are stored in AzureMetrics.

• Metrics exported through platform telemetry DCRs are stored in AzureMetricsV2.

• KQL is used to query and analyze the collected data.

• Data ingestion and retention may incur charges.

Microsoft documentation: Azure Monitor Diagnostic Settings and Metrics export using DCRs.