Hi, I'm Roy product manager in the Log Analytics team. Today
I wanted to discuss Log
Analytics scopes. In today's session, will review the general
Azure structure. Log Analytics workspace log
analytics for resource centric scenarios for a
single resource and for a scope of resources and the
Log Analytics scope picker. Let's begin. Azure is the
world's computer. It offers a variety of resources enabling
the delivery of amazing value to you and your customers.
Azure resources are grouped in resource group for easy
management, resource groups are grouped in subscriptions.
The Azure log analytics Workspace is an Azure
resource. You can think of the workspace as a container for
logs in. Azure Resources may send logs to a single
workspace or to multiple workspaces. This allows for
great flexibility when managing logs, but it's not
always needed.
As mentioned before, the log analytics workspace is an Azure
Resource. As such, it allows for different management
capabilities such as access control and more. Additionally,
the Log Analytics Workspace also acts as a container for
logs, allowing you to manage various aspects of your log
analytics setup such as role based access control, retention
policies and more.
The Log Analytics workspace is not only a logs management
container, it also allows exploration of logs. Since the
workspace stores logs from various resources, it's great
for exploring logs across
resources. Our workspace may also contain logs from
instances that are not classic Azure resources such as Active
Directory. Azure's common structure is resource oriented.
Log Analytics also offers a context specifically tailored
for this. We call it resource centric view when accessing logs
from supporting resources table
of contents. Logs will collect all the logs
relevant to the specific resource, even if it's
stored in multiple workspaces. This way of
exploring logs is ideal for debugging and understanding
a specific resource.
The same idea also works for a scope of resources
like a resource group when exploring logs for a
resource group, log analytics will
automatically collect all logs from all resources in
that resource Group.
In addition to these implicit ways of determining your scope,
Logan Analytics also allows the management of the scope using
the scope picker when selecting a scope using the scope picker,
your query will return results only from the scope selected,
allowing you to better control your scope and help you focus on
queries and reach the insights you need fast.
Let's see a demo of all these capabilities as they come into
expression in Log Analytics. This is a log analytics
workspace. When entering logs in, the workspace for the first
time, I'm greeted with the example queries dialogue.
For a demo, I want to look at the VMS in this workspace, so
I'll change the filtering of the example queries to only show
queries relevant to VMs.
I would choose the track VM availability to get
availability data for all the VM's sending data to
this workspace. Note that I'm getting hits from
multiple different VMS. I can change the query to show
a list of all VMs sending data to this workspace.
Note the JBOX00 VM is sending data to this workspace.
Let's continue and see the behavior for this specific VM.
I will go to the JBOX VM00 resource in Azure
and click the logs menu.
Note that for a resource centric context, Log
Analytics automatically filters the example queries
according to the resource that I'm in to provide me
with easier access to the queries I need. I will run
the same query.
Note that this time I only get hits from this specific VM.
I can use the scope picker to add more VMS to my query and
query across multiple resources.
Let's add this one.
If I run the query again you can see I get hits from the
two VMS I selected.
The same principle also works for a resource group.
Let's go to a resource group that has multiple VMS.
Go to the logs menu and run the same exact query.
Not that I get hits from multiple VMS and Log Analytics
automatically collect the data for all the VMS even if they are
saved across multiple workspaces. This is not all
Log Analytics offer more advanced powerful capabilities
like querying across workspaces and across resources. This
allows you visibility into various aspects of your states
and a powerful advanced ways to
get insight. To summarize, Logan Analytics has a powerful and
efficient scoping mechanism allowing you to quickly and
easily control what you query, log analytics basics
functionality caters to most people needs in most scenarios,
however, Log Analytics is super flexible, allowing users
who need to to create advanced queries, spanning scopes, and
workspaces. I hope you enjoyed this short video. Join our
community to get the latest updates on Log Analytics, and
interact with other users. See the links below this video for
our community. And additional learning and
documentation resources.