Skip to main content

​
Log Analytics Workspaces

​
List Log Analytics Workspaces

Retrieve all Log Analytics workspaces in a subscription

​
Query Parameters

​
subscriptionId
string
required
Azure subscription ID

​
Response

​
value
array
Array of workspace objects
​
name
string
Workspace name
​
id
string
Full Azure resource ID
​
location
string
Azure region
​
workspaceGuid
string
Workspace GUID (customer ID)
​
sku
string
Pricing tier (e.g., “PerGB2018”)
​
retentionInDays
number
Data retention period in days
​
resourceGroup
string
Resource group name

​
Create Log Analytics Workspace

Create a new Log Analytics workspace

​
Request Body

​
subscriptionId
string
required
Azure subscription ID
​
rgName
string
required
Resource group name
​
workspaceName
string
required
Workspace name
​
location
string
default:"westeurope"
Azure region
​
sku
string
default:"PerGB2018"
Pricing tier (“PerGB2018”, “PerNode”, “Standard”, “Premium”)
​
retentionInDays
number
default:30
Data retention period (30-730 days)

​
Response

​
message
string
Success message
​
workspace
object
Workspace details
​
name
string
Workspace name
​
id
string
Full resource ID
​
location
string
Azure region

​
Data Collection Rules

​
List Data Collection Rules for VM

List all Data Collection Rules associated with a VM

​
Path Parameters

​
vm_id
string
required
Virtual machine name

​
Query Parameters

​
workspaceId
string
Filter by workspace resource ID (optional)

​
Response

​
value
array
Array of DCR associations
​
associationName
string
Association name
​
dcrId
string
Full DCR resource ID
​
dcrName
string
DCR name
​
description
string
Optional description

​
Create DCR and Associate with VM

Create a Data Collection Rule and link it to a VM

​
Request Body

​
subscriptionId
string
required
Azure subscription ID
​
resourceGroup
string
required
Resource group name
​
dcrName
string
required
Data Collection Rule name
​
location
string
required
Azure region
​
workspaceId
string
required
Log Analytics workspace resource ID
​
vmResourceId
string
required
Full VM resource ID
​
collectPerformance
boolean
default:true
Collect performance counters
​
collectSystemLogs
boolean
default:true
Collect system logs (Windows Event Log or Syslog)

​
Response

​
message
string
Success message
​
dcrId
string
Created DCR resource ID
​
associationId
string
Association resource ID

​
Data Sources

Performance Counters (if enabled):
  • \Processor(_Total)\% Processor Time
  • \Memory\Available MBytes
  • Sampling frequency: 60 seconds
System Logs (if enabled):
  • Windows: System and Application event logs (Level 1-3)
  • Linux: Syslog (all facilities and levels)

​
VM Logs

​
Export VM Logs to CSV

Export VM logs as CSV file

​
Path Parameters

​
vm_id
string
required
Virtual machine name

​
Query Parameters

​
workspaceGuid
string
required
Log Analytics workspace GUID
​
type
string
default:"heartbeat"
Log type: “heartbeat” or “perf”
​
hours
number
default:1
Time range in hours

​
Response

CSV file download with semicolon delimiter

​
Query VM Logs

Execute custom KQL query for VM logs

​
Request Body

​
workspaceGuid
string
required
Log Analytics workspace GUID
​
kqlQuery
string
required
KQL query (must filter by Computer == '')

​
Security

  • Query must include filter: Computer == '{vm_id}'
  • Dangerous keywords blocked: delete, update, modify, insert, drop
  • Read-only access enforced

​
Response

​
value
array
Array of log records (dynamic schema based on query)

​
VM Alerts

​
List Alerts for VM

List all metric alerts for a virtual machine

​
Path Parameters

​
vm_id
string
required
Virtual machine name

​
Response

​
value
array
Array of alert objects
​
name
string
Alert name
​
description
string
Alert description
​
severity
number
Severity level (0-4)
​
enabled
boolean
Whether alert is active
​
scopes
array
Resource IDs monitored by this alert
​
evaluationFrequency
string
Evaluation frequency (e.g., “PT1M”)
​
windowSize
string
Time window size (e.g., “PT5M”)

​
Create Metric Alert for VM

Create a new metric alert for a VM

​
Request Body

​
alertName
string
required
Alert rule name
​
metricName
string
required
Azure metric name (e.g., “Percentage CPU”, “Available Memory Bytes”)
​
threshold
number
required
Threshold value for the metric
​
notifyEmail
string
required
Email address for alert notifications

​
Response

​
message
string
Success message
​
alertRuleId
string
Created alert rule resource ID
​
actionGroupId
string
Created action group resource ID

​
Alert Configuration

  • Severity: 3 (Informational)
  • Evaluation Frequency: 1 minute
  • Window Size: 5 minutes
  • Operator: GreaterThan
  • Time Aggregation: Average
  • Action Group: Created automatically with email receiver

​
Delete VM Alert

Delete a metric alert

​
Path Parameters

​
vm_id
string
required
Virtual machine name
​
alert_name
string
required
Alert name to delete

​
Response

​
message
string
Confirmation message

​
Container Monitoring

​
Get Container Metrics

Retrieve Azure Monitor metrics for a container instance

​
Path Parameters

​
container_group_name
string
required
Container group name

​
Response

​
subscriptionId
string
Azure subscription ID
​
resourceGroup
string
Resource group name
​
resourceId
string
Full resource ID
​
location
string
Azure region
​
containerName
string
Container name
​
metrics
array
Metric data
​
name
string
Metric name (“CpuUsage”, “MemoryUsage”)
​
unit
string
Unit of measurement
​
data
array
Time series data points
​
timestamp
string
ISO 8601 timestamp
​
average
number
Average value
Timespan: Last 1 hour
Interval: 1 minute

​
Get Container Linked Workspace

Get the Log Analytics workspace linked to a container

​
Response

​
value
object
Workspace details (null if not linked)
​
id
string
Workspace resource ID
​
name
string
Workspace name
​
location
string
Azure region
​
workspaceGuid
string
Workspace GUID

​
Export Container Logs

Export container logs as CSV

​
Query Parameters

​
workspaceGuid
string
required
Log Analytics workspace GUID
​
hours
number
default:1
Time range in hours
​
type
string
default:"container"
Log type

​
Response

CSV file download with logs (top 500 entries)

​
Run Container KQL Query

Execute custom KQL query for container logs

​
Request Body

​
workspaceGuid
string
required
Log Analytics workspace GUID
​
kqlQuery
string
required
KQL query (must filter by ContainerGroup_s == '')

​
Response

​
columns
array
Column names
​
rows
array
Query results

​
Container Alerts

​
List Container Alerts

List metric alerts for a container instance

​
Query Parameters

​
sub_id
string
required
Azure subscription ID
​
rg_name
string
required
Resource group name

​
Response

​
alerts
array
Array of alert objects
​
name
string
Alert name
​
description
string
Alert description
​
enabled
boolean
Active status
​
severity
number
Severity level (0-4)
​
criteria
string
Alert criteria (stringified)
​
scopes
array
Resource IDs

​
Create Container Alert

Create a metric alert for a container

​
Request Body

​
subscriptionId
string
required
Azure subscription ID
​
resourceGroup
string
required
Resource group name
​
actionGroupId
string
required
Action group resource ID for notifications
​
threshold
number
default:80
Threshold value
​
metricName
string
default:"CpuUsage"
Metric name
​
operator
string
default:"GreaterThan"
Comparison operator
​
timeWindow
string
default:"PT5M"
Time window (ISO 8601 duration)
​
evaluationFrequency
string
default:"PT1M"
Evaluation frequency (ISO 8601 duration)

​
Response

​
message
string
Success message
​
alertName
string
Created alert name

​
Delete Container Alert

Delete a container metric alert

​
Request Body

​
subscriptionId
string
required
Azure subscription ID
​
resourceGroup
string
required
Resource group name
​
alertName
string
required
Alert name to delete

​
Response

​
message
string
Confirmation message

Build docs developers (and LLMs) love

Get started for freeTalk to us