Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

How can we improve Azure Log Analytics ?

You've used all your votes and won't be able to post a new idea, but you can still search and comment on existing ideas.

There are two ways to get more votes:

  • When an admin closes an idea you've voted on, you'll get your votes back from that idea.
  • You can remove your votes from an open idea you support.
  • To see ideas you have already voted on, select the "My feedback" filter and select "My open ideas".
(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback

  1. Support wildcards for field values in search

    Being able to use naming convention in criteria would be very useful, i.e. Computer="SRV0*". Having to enter exact names makes exploration less versatile.

    91 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    5 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    You can now do wildcard searches.

    e.g.
    Computer=svel*
    Type=WireData RemoteIP:172?16*
    Type:Perf CounterName=Processor

    A couple of things to note:

    • Do not enclose the value in quotes – it will look for * as the actual value to match
    • For strings with . in them, use the ? to match (. is not currently a valid character in non-quoted string literals)
    • Use ? to match spaces in strings

  2. Long-Running Saved Searches (or scheduled) that can generate an Alert and/or email notification

    This could be useful for daily/weekly reports, as well for 'monitoring' type scenario.
    The basic idea is you could be scheduling your query to run every so often, and then take some action such as raising an alert or email you the Excel/CSV results out, etc...

    It would again - like dashboards - build on the foundation of 'saved searches' http://blogs.technet.com/b/momteam/archive/2014/07/25/system-center-advisor-limited-preview-saved-searches-cloud-attach-status-and-usage-and-more.aspx

    You could ask HTML/Text or Excel output of results, or a customizable message you define, like in a SCOM Alert http://blogs.technet.com/b/momteam/archive/2014/08/29/check-it-out-export-advisor-search-results-to-excel.aspx

    Or it could produce an Alert and store it in Search.

    Or all of the above?

    91 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    9 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  3. Easy way to fetch the last datapoint for a specific set of computers

    I need a way to fetch the last data document for a given set of computers (1 to all) for a given DataSource.
    - last performance point
    - last IIS log entry
    - ...
    while this can be done for a single computer using the TOP clause and ordering by TimeGenerated I didn't find a way to get it for a set of computers.
    The IN clause seems to just for computer and it doesn't support the full query language, for example: Type=Perf TimeGenerated IN {Type=Perf | measure max(TimeGenerated) As TimeGenerated by Computer | select TimeGenerated} doesn't work, it says…

    71 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    3 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminAzure Log Analytics (Admin, Microsoft Azure) responded

    Hi,

    With the recent upgrade of our query language, this option is supported out-of-the-box.
    In the example below, the operators argmax() and in() are being used to retrieve the latest record in a given data source, for each computer in a dynamically-created set of computers.
    I also used “let” to name that list, in this example it’s a set of computers that are missing updates.

    let computers_that_need_update =
    Update
    | where TimeGenerated > now(-1d)
    | where UpdateState == “Needed”
    | summarize makeset(Computer);
    Heartbeat | summarize argmax(TimeGenerated, *) by Computer | where Computer in (computers_that_need_update)

    To learn more about the new query language, check out the language documentation site: http://docs.loganalytics.io/

    Regards,
    Noa

  4. Increase the supported number of grouping fields for MEASURE command

    Currently the "MEASURE" command in OMS Search language supports group by up to 3 fields. In order to pass aggregated NRT perf data to Power BI and produce meaningful Power BI reports, we need 5 fields in the Power BI dataset: ObjectName, Computer, CounterName, InstanceName and CounterPath. We are not able to produce a search query in OMS that passes all 5 fields to Power BI because the measure command only supports group by up to 3 fields. i.e. Type=Perf | measure avg(CounterValue) by Computer,CounterName,InstanceName
    Please consider lift this number from 3 to 5 so we can pass all required…

    70 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminAzure Log Analytics (Admin, Microsoft Azure) responded

    Hi,

    With the recent upgrade or our query language, this option is supported out-of-the-box.
    The given example would be translate to this in the new language:

    Perf
    | summarize average_value= avg(CounterValue) by Computer, ObjectName, CounterName, CounterPath, InstanceName

    I am not aware of a limit on the number of dimensions to group by. For example you can also add SourceSystem and group in 2-hour buckets of TimeGenerated:
    Perf | summarize average_value= avg(CounterValue) by Computer, ObjectName, CounterName, CounterPath, InstanceName, SourceSystem, bin(TimeGenerated, 2h)

    The full documentation is available here: https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/summarize-operator

    Regards,
    Noa

  5. Integrate with PowerBI - allow to query and refresh data via OpInsights searches within PowerBI

    This is the follow up scope after our initial Export to Excel functionality introduced here http://blogs.technet.com/b/momteam/archive/2014/08/29/check-it-out-export-advisor-search-results-to-excel.aspx

    61 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    8 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  6. Bring back the Preview Feature "PowerBI Integration"

    We use this feature in the past with an older OMS instance to push search data from OMS to Power BI and it is very helpful for us. With newer instances there is no possibility to activate this feature, so please bring it back as soon as possible.

    60 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  7. Back button

    It would be nice a back button to drill up the queries. I know that already have a history on query texbox, but we are more familiar with a back button. I always click on the browser back button, that always redirects me to the home page of OMS, not the last query.

    58 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    3 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  8. Be able to set case sensitiveness for data in searches

    Scenario.
    Run this query * | Measure Max(TimeGenerated) by ComputerName
    I have multiple entries for several computers since different IPs have set the name with different case combinations.
    Every time we search or aggregate we should be able to specify if we want to be case sensitive or insensitive. If it's too expensive, just default to case insentiveness since I think it's the more common usage.

    56 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    8 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminAzure Log Analytics (Admin, Microsoft Azure) responded

    Hi,

    With the recent upgrade or our query language, this option is supported out-of-box.
    The given example would be translate to this in the new language:
    `search * | summarize AggregatedValue = max(TimeGenerated) by tolower(Computer)`

    Note that “tolower” was used to create groups by computer names, regardless if it’s upper/lower case in the raw data.

    To compare values that are not even aggregated, you can now select the case-sensitive or insensitive operators.
    For example:
    Heartbeat | where Computer == “contoSOWEB” vs. Heartbeat | where Computer =~ “contoSOWEB”
    Heartbeat | where Computer containscs “CONTOSO” vs. Heartbeat | where Computer contains “CONTOSO”

    Another use case could be to get the latest record relating to each computer in a given table, for example to find the latest heartbeat of each computer. argmax is the best operator for that. If somehow different logs use different cases for the same computer,…

  9. Display in Local Time

    Have the option to display date/time value in local time instead of UTC/GMT.

    46 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    3 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  10. Search autocomplete or Intellisense-like assisted search typing

    Autocomplete within search for fields/facets/functions would be useful for exploration.

    46 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  11. Ability to store Lookup Lists/Groups and use them in Query Language

    While the IN operator and sub-searches partially enabled some level of 'grouping' - see this http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519234-filter-groups-of-computers-thru-subqueries-in-n it would also be useful to just store/persist a list (of computer names, user names, file names... whatever the fields of your data contain).

    This can be useful for a series of scenarios, one example is for Security Solution to use query filters that are based on members of an Active Directory Group. It would be great if the query language support Active Directory Groups with users/computers to use as a filter.

    Read the comment thread for more information.

    36 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    10 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  12. Filter Groups of Computers thru subqueries (IN / NOT IN operators)

    Would very much need some way to filter the queries to only SQL, Exchange, Sharepoint, Lync, etc. servers. Maybe use SCOM groups somehow? Basically our SQL team would need an easy view to only see SQL servers and not have to enter each server name on the filter query. For example show me: "SQL servers, disk size > 5 GB"

    36 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    In OMS we wanted to re-define the idea of what a group is. Since groups are essentially lists of machines we think the ability to do sub-queries is a key ingredient i.e. give me the list of machines that are sql servers is one ‘inner’ query – and then your outer query checks for data where the value of Computer is IN any of the values in the inner query results.

    The basic functionality for this is implemented and enabled now.
    Read more about it in the blog post http://blogs.msdn.com/b/dmuscett/archive/2015/05/30/operations-management-suite-log-search-how-to-part-viii-the-in-operator-and-subsearches.aspx

    The core functionality is that you now can feed an inner query that uses measure into an outer query. This was also demoed at Ignite in this session http://channel9.msdn.com/Events/Ignite/2015/BRK3500

    There is an additional proposal (continued scope) to allow persisting static ‘lists’ (of computer names, user names, whatever) as groups, to be fed to the IN operator, as opposed to full…

  13. Measure command should allow to Group By more than one field

    I've tried to create a dashboard that shows the average time taken for webservices by csuristem, but cannot group by another with the measure tab. I'd love to be able to measure and group by more than one field.

    30 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  14. Allow Search Queries to be Saved as 'Favorites'

    Favorites or bookmarks could replace the canned, hard-coded queries that are now present in the search page and in various Intelligence Pack's drill downs.
    Users should also be able to save their own favorites in the Advisor account for easy/routine access.

    25 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  15. Allow resize of columns in Table view for aggregated search results

    19 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  16. Columns in Search

    Would be nice if you could select the columns you want to see in the search result window as well as being able to resize the column width and select number of rows to see.

    15 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    3 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

  17. Ability to switch Display Time from Local Time to UTC and back

    User needs to be able to select the preferable format for him to display time in the OMS Portal. (Ability to select LOCAL TIME or UTC)

    Examples where Time appears in the portal are: 1) Time selector widget 2) Time in search results, etc

    12 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminAzure Log Analytics (Admin, Microsoft Azure) responded

    Hi,

    With the recent upgrade of Log Analytics, the advanced portal was also introduced.
    This portal provides a rich query editing environment, and includes this feature as well.
    Take a look at the demo environment here: https://portal.loganalytics.io/demo#/discover/query/results/table

    In the basic log search page this feature is not available, but you can still add a “localtime” column with the calculate value, for example:
    Event
    | where TimeGenerated > now(-1d)
    | extend PST = TimeGenerated-8h

    Hope this helps.
    Regards,
    Noa

  18. Export Search Results to Excel or CSV for custom reporting and analysis of data

    Allowing Excel export with the ability to perform most of the filtering and some pre-processing on Advisor side, and continue in Excel.

    12 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    We have enabled CSV export as a first iteration.
    It’s live now: look for the EXPORT button at the bottom left of the search results page! Read the blog here http://blogs.technet.com/b/momteam/archive/2014/08/29/check-it-out-export-advisor-search-results-to-excel.aspx , use it, and let us know what you think!

    For the (more involved) scope with regards to a ‘true’ PowerBI integration, please look at/vote this new idea http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519374-integrate-with-powerbi-allow-to-query-and-refres

  19. Integrate Search into OpsMgr Dashboards

    Allow contextual search of logs driven by OpsMgr objects and display results in OpsMgr dashboards

    12 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    At TechED North America this year in our session on System Center Advisor we briefly showed a proof of concept on how to contextually drive System Center Advisor search using Operations Manager dashboards. We now have this integration ready for you all to use.

    The sample dashboards and scripts used to highlight this integration are linked below:

    Sample Advisor dashboard with event search : http://gallery.technet.microsoft.com/PSWB-Dashboards-to-84cc6cef

    Sample simple performance search : http://gallery.technet.microsoft.com/PSWB-Script-to-run-a-d76ef411

    Sample complex performance search : http://gallery.technet.microsoft.com/PSWB-Script-to-run-complex-718255da

    Read more on the momteam blog http://blogs.technet.com/b/momteam/archive/2014/08/14/integrate-system-center-advisor-into-operations-manager-dashboards.aspx

  20. Deep link URL to search results

    Allow sharing of links that go direct to searches. Deep linking doesn't seem to work and always lands me on the home Overview page, but it would be REALLY nice to be able to click on a URL in a OneNote clipping and let it take you to a live view.

    11 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
    completed  ·  AdminAzure Log Analytics (Admin, Microsoft Azure) responded

    Hi,

    With the recent upgrade of Log Analytics, the advanced portal was introduced – and it actually supports this feature.
    This is a demo environment you can use: https://portal.loganalytics.io/demo#/discover/query/results/table
    Once you have a valid query, click the “Export” menu and then “share a link to query”.

    Here is an example link to a query, generated this way:
    https://portal.loganalytics.io/Demo?q=H4sIAAAAAAAAA3MtS80r4eWqUSjPSC1KVQjOLy1KTlWwtVVQciwoyMlMTizJzM9TcC0qyi9S4gIA4iUf2S0AAAA%3D×pan=P1D

    Regards,
    Noa

← Previous 1 3
  • Don't see your idea?

Azure Monitor-Log Analytics

Categories

Feedback and Knowledge Base

(thinking…)
Hosted by UserVoice