Introduction

The log search feature enables you to combine, correlate, query, and retrieve data from Log Analytics. Recall that Log Analytics enables you to collect and aggregate large amounts of data from heterogeneous sources; we reviewed some of those capabilities in Chapter 1, Getting Started with Microsoft Operations Management Suite. As mentioned in the previous chapter, the collected data, is only as useful as the insights that can be derived from them, and the subsequent actions that those insights inform. This is where the Log Analytics query language comes to the fore.

The new and improved Log Analytics query language is based on Analytics (codenamed Kusto)—the powerful search feature in Application Insights, which Microsoft has recently made available as an upgrade for Log Analytics workspaces. The Log Analytics query language is optimized to perform and handle data at cloud scale, and it offers several very significant and noteworthy improvements over the legacy language.

In addition to such tasks as working with and manipulating large datasets, which you can perform with the legacy language, the interactive Log Analytics query language introduces a simpler and more intuitive syntax structure with full piping capabilities, and enables you to perform such incredibly powerful tasks as advanced joins, data and time functions, search-time field extractions, and smart analytics for evaluating patterns in large datasets and comparing datasets. The Log Analytics query language also improves upon the visualization capabilities in the legacy language, and features better integration with Power BI, enabling you to export queries for use in Power BI Desktop, for instance. With the Log Analytics query language, you can perform tasks such as the following:

• Filtering indexed data by any field, including your custom properties and application and workspace metrics
• Joining multiple tables
• Performing powerful statistical aggregations
• Working with intuitive and powerful visualizations
• Running queries programmatically from PowerShell using the REST API