Query logs (KQL)
azure_logs_queryRun KQL queries against Azure Monitor Logs to investigate application telemetry, errors, and resource logs across workspaces, Application Insights, and specific resources.
Instructions
Runs a KQL query against Azure Monitor Logs. scope can be a Log Analytics workspace (queries the whole workspace), an Application Insights resource, or any other resource (only that resource's logs, from every workspace it sends to). Application Insights tables: AppRequests, AppDependencies, AppExceptions, AppTraces. App Service: AppServiceHTTPLogs, AppServiceConsoleLogs. AKS: ContainerLogV2, KubePodInventory, KubeEvents. Example: {"scope": "", "query": "AppRequests | where Success == false | summarize count() by ResultCode, Name | top 10 by count_"}. Use azure_telemetry_locations to find the right scope.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 24, max 2160). | |
| limit | No | Maximum rows (default 100). | |
| query | Yes | KQL query. | |
| scope | Yes | Resource ID of a Log Analytics workspace, Application Insights resource, or any resource. |