Welcome to Azure monitor log analytics. In this video will
introduce log analytics and show you how to easily get instant
insights from your logs. This demo assumes you already on
boarded the logs and that data is being sent to log analytics.
If this is not the case yet, refer to our documentation or
tutorial video on how to set up your logs. Now let's get started
with logs. In this video we demonstrate how to view and
query logs on a single Kubernetes cluster resource, but
the same principles demonstrated here are applicable to all log
scopes. A quick and easy way to get started is to use our
query screen. The query screen holds prebuilt example
queries. Another save queries making it an ideal place to
start. You can filter your queries according to resource
type, category, topics and other tags to find what you
need.
Additionally, when viewing the logs for a single resource, we
automatically apply a filter to show you queries that are
relevant to the resource type that you are currently
exploring. In this case, since I access logs from Kubernetes
cluster, the Kubernetes services filter was pre
populated. Note that we also have a special section for
queries specifically optimized for alerts to quickly create
helpful alerts for your resources.
You can also change the grouping of the queries so that they are
arranged in a way that's convenient for you, and you can
search example queries to find just the right insight for you.
In our example, will try to find errors in this clusters
container, logs to do this will search for the word find and we
can see that will easily get an example query to help us get
started from this point. Things are simple, will load the
example to the editor and follow the instructions. In this
specific case, we need to tell the quality. What's the shrink
that we're after in our scenario, will find all of the
warning messages in the logs.
So we simply update the query with the string warning in the
right place and then click run and we get our results out on
the screen ready for exploration. The same experience
is also available for queries listed in the sidebar.
If you don't find the right example query for you, you can
also start your log exploration from the tables level. The table
view behaves much in the same way as the queries view. You can
groupby and filter your tables according to the resource type,
category and solution. By default we only show tables
containing log data in the table sidebar. However, you can easily
view all the tables by changing the relevant setting. Note that
the table view only displays the tables relevant to the log
analytics scopes that you're in. This means that in our scope.
A single Kubernetes cluster. We only see tables relevant for
Kubernetes. You can also hover over the tables for an
informative popup containing a short table description and a
link to the tables. Full description and documentation.
And starting a query from the table is straightforward. Double
clicking on the table name gives you a preview of the data and
then you can load it into the
editor. Now that we have our first result set, we're ready to
get started. Long Analytics uses KQLA query language that's very
easy to use for exploration. Each stage in the KQL statement
produces a table at each table produced. Is the input for the
next stage we use the pipe operator to define new stages.
If we look at the table that we got from preview, we can see
that the container logs table was filtered for the last 24
hours and limited to just 10 records being returned. We can
easily change the filtering much in the same way.
We change it in any other query language. Let's try and filter
the table for rows containing only warning, just as we did in
the example query. First will explore the columns available in
the resultset. And here we see that the log entry column has
text describing the error. Will add the pipe operator to the
query and then where log entry has warning to retrieve similar
results to those that we got using. The example query will
also change the query to fetch only 1000 records instead of 10.
Now we'll click run.
And get the result set.
Additional exploration capabilities are available right
from the UI. You can sort and filter the result set and
visualize your results to gain
faster insights. You can choose to sort by time or another
column, and you can add filters to limit the resultset.
You may also use the built in time filter to narrow down the
scope of the time queried right from the UI. Let's use the time
range filter to look only at the last hour of data, even if at
times scope is set in your query as it is in our case. Here you
can select the time scope smaller than the one in your
query and the query will be scoped to the time set in the
picker and this is just the beginning log analytics with the
power of KQL offers an easy and powerful way to get insights
from your logs. Log analytics also integrates well with other.
Azure and Microsoft assets allowing you to create useful
alerts dashboard export to Excel and share your queries
and insights. Explore log analytics to see how you can
leverage it for your use cases. We hope this short
guide was helpful. Please visit our documentation to
learn more about KQL, how to utilize this powerful query
language for fast and powerful insights from your logs.