Azure Monitor Query client library for Python

Azure Monitor helps you maximize the availability and performance of your apps. It delivers a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments.

All data collected by Azure Monitor fits into one of two fundamental types:

• Metrics - Numerical values that describe some aspect of a system at a particular time. They're lightweight and can support near real-time scenarios.
• Logs - Disparate types of data organized into records with different sets of properties for each type. Performance data and telemetry such as events, exceptions, and traces are stored as logs.

To programmatically analyze these data sources, the Azure Monitor Query client library can be used.

Source code | Package (PyPI) | API reference documentation | Product documentation | Samples | Changelog

Getting started

Prerequisites

• Python 2.7, or 3.6 or later.
• An Azure subscription.

Install the package

Install the Azure Monitor Query client library for Python with pip:

pip install azure-monitor-query --pre

Create the client

To interact with the Azure Monitor service, create an instance of a token credential. Use that instance when creating a LogsQueryClient or MetricsQueryClient.

Synchronous clients

Consider the following example, which creates synchronous clients for both logs and metrics querying:

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient, MetricsQueryClient

credential = DefaultAzureCredential()
logs_client = LogsQueryClient(credential)
metrics_client = MetricsQueryClient(credential)

Asynchronous clients

The asynchronous forms of the query client APIs are found in the .aio-suffixed namespace. For example:

from azure.identity.aio import DefaultAzureCredential
from azure.monitor.query.aio import LogsQueryClient, MetricsQueryClient

credential = DefaultAzureCredential()
async_logs_client = LogsQueryClient(credential)
async_metrics_client = MetricsQueryClient(credential)

Key concepts

Logs

Azure Monitor Logs collects and organizes log and performance data from monitored resources. Data from different sources can be consolidated into a single workspace. Examples of data sources include:

• Platform logs from Azure services.
• Log and performance data from virtual machine agents.
• Usage and performance data from apps.

Azure Log Analytics workspaces

Data collected by Azure Monitor Logs is stored in one or more Log Analytics workspaces. The workspace defines the:

• Geographic location of the data.
• Access rights defining which users can access data.
• Configuration settings, such as the pricing tier and data retention.

Log queries

Data from the disparate sources can be analyzed together using Kusto Query Language (KQL)—the same query language used by Azure Data Explorer. Data is retrieved from a Log Analytics workspace using a KQL query—a read-only request to process data and return results. For more information, see Log queries in Azure Monitor.

Metrics

Azure Monitor Metrics collects numeric data from monitored resources into a time series database. Metrics are collected at regular intervals and describe some aspect of a system at a particular time. Metrics in Azure Monitor are lightweight and can support near real-time scenarios. They're useful for alerting and fast detection of issues. Metrics can be:

• Analyzed interactively with Metrics Explorer.
• Used to receive notifications with an alert when a value crosses a threshold.
• Visualized in a workbook or dashboard.

Metrics data structure

Each set of metric values is a time series with the following characteristics:

• The time the value was collected
• The resource associated with the value
• A namespace that acts like a category for the metric
• A metric name
• The value itself
• Some metrics may have multiple dimensions as described in multi-dimensional metrics. Custom metrics can have up to 10 dimensions.

Examples

• Single logs query
  • Specify duration
  • Set logs query timeout
• Batch logs query
• Query metrics
• Handle metrics response
  • Example of handling response
• Advanced scenarios
  • Query multiple workspaces

Single logs query

This example shows getting a log query. To handle the response and view it in a tabular form, the pandas library is used. See the samples if you choose not to use pandas.

Specify duration

The duration parameter specifies the time duration for which to query the data. This argument can also be accompanied with either start_time or end_time. If either start_time or end_time aren't provided, the current time is used as the end time. As an alternative, the start_time and end_time arguments can be provided together instead of the duration argument. For example:

import os
import pandas as pd
from datetime import datetime
from azure.monitor.query import LogsQueryClient
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

# Response time trend
# request duration over the last 12 hours
query = """AppRequests |
summarize avgRequestDuration=avg(DurationMs) by bin(TimeGenerated, 10m), _ResourceId"""

# returns LogsQueryResult
response = client.query(
    os.environ['LOG_WORKSPACE_ID'],
    query,
    start_time=datetime(2021, 6, 2),
    end_time=datetime.now()
    )

if not response.tables:
    print("No results for the query")

for table in response.tables:
    df = pd.DataFrame(table.rows, columns=[col.name for col in table.columns])
    print(df)

Set logs query timeout

The following example shows setting a server timeout in seconds. A gateway timeout is raised if the query takes more time than the mentioned timeout. The default is 180 seconds and can be set up to 10 minutes (600 seconds).

import os
import pandas as pd
from azure.monitor.query import LogsQueryClient
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query(
    os.environ['LOG_WORKSPACE_ID'],
    "range x from 1 to 10000000000 step 1 | count",
    server_timeout=1,
    )

Batch logs query

The following example demonstrates sending multiple queries at the same time using batch query API. The queries can either be represented as a list of LogQueryRequest objects or a dictionary. This example uses the former approach.

import os
from datetime import timedelta
import pandas as pd
from azure.monitor.query import LogsQueryClient, LogsQueryRequest
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

requests = [
    LogsBatchQueryRequest(
        query="AzureActivity | summarize count()",
        duration=timedelta(hours=1),
        workspace_id=os.environ['LOG_WORKSPACE_ID']
    ),
    LogsBatchQueryRequest(
        query= """AppRequests | take 10  |
            summarize avgRequestDuration=avg(DurationMs) by bin(TimeGenerated, 10m), _ResourceId""",
        duration=timedelta(hours=1),
        start_time=datetime(2021, 6, 2),
        workspace_id=os.environ['LOG_WORKSPACE_ID']
    ),
    LogsBatchQueryRequest(
        query= "AppRequests | take 2",
        workspace_id=os.environ['LOG_WORKSPACE_ID']
    ),
]
response = client.batch_query(requests)

for rsp in response:
    body = rsp.body
    if not body.tables:
        print("Something is wrong")
    else:
        for table in body.tables:
            df = pd.DataFrame(table.rows, columns=[col.name for col in table.columns])
            print(df)

Handling the response for Logs Query

The query API returns the LogsQueryResult while the batch_query API returns the LogsBatchQueryResult.

Here is a heirarchy of the response:

LogsQueryResult / LogsBatchQueryResult
|---id (this exists in `LogsBatchQueryResult` object only)
|---status (this exists in `LogsBatchQueryResult` object only)
|---statistics
|---render
|---error
|---tables (list of `LogsQueryResultTable` objects)
    |---name
    |---rows
    |---columns (list of `LogsQueryResultColumn` objects)
        |---name
        |---type

So, to handle a response with tables and display it using pandas,

table = response.tables[0]
df = pd.DataFrame(table.rows, columns=[col.name for col in table.columns])

A full sample can be found here.

In a very similar fashion, to handle a batch response,

for result in response:
    table = result.tables[0]
    df = pd.DataFrame(table.rows, columns=[col.name for col in table.columns])

A full sample can be found here.

Query metrics

The following example gets metrics for an Event Grid subscription. The resource URI is that of an event grid topic.

The resource URI must be that of the resource for which metrics are being queried. It's normally of the format /subscriptions/<id>/resourceGroups/<rg-name>/providers/<source>/topics/<resource-name>.

To find the resource URI:

1. Navigate to your resource's page in the Azure portal.
2. From the Overview blade, select the JSON View link.
3. In the resulting JSON, copy the value of the id property.

import os
from datetime import timedelta
from azure.monitor.query import MetricsQueryClient
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = MetricsQueryClient(credential)

metrics_uri = os.environ['METRICS_RESOURCE_URI']
response = client.query(
    metrics_uri,
    metric_names=["PublishSuccessCount"],
    start_time=datetime(2021, 5, 25),
    duration=timedelta(days=1),
    )

for metric in response.metrics:
    print(metric.name)
    for time_series_element in metric.timeseries:
        for metric_value in time_series_element.data:
            print(metric_value.time_stamp)

Handle metrics response

The metrics query API returns a MetricsResult object. The MetricsResult object contains properties such as a list of Metric-typed objects, interval, namespace, and timespan. The Metric objects list can be accessed using the metrics param. Each Metric object in this list contains a list of TimeSeriesElement objects. Each TimeSeriesElement contains data and metadata_values properties. In visual form, the object hierarchy of the response resembles the following structure:

MetricsResult
|---interval
|---timespan
|---cost
|---namespace
|---resourceregion
|---metrics (list of `Metric` objects)
    |---id
    |---type
    |---name
    |---unit
    |---timeseries (list of `TimeSeriesElement` objects)
        |---metadata_values
        |---data (list of data points represented by `MetricValue` objects)

Example of handling response

import os
from datetime import datetime, timedelta
from azure.monitor.query import MetricsQueryClient, AggregationType
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = MetricsQueryClient(credential)

metrics_uri = os.environ['METRICS_RESOURCE_URI']
response = client.query(
    metrics_uri,
    metric_names=["MatchedEventCount"],
    start_time=datetime(2021, 6, 21),
    duration=timedelta(days=1),
    aggregations=[AggregationType.COUNT]
    )

for metric in response.metrics:
    print(metric.name)
    for time_series_element in metric.timeseries:
        for metric_value in time_series_element.data:
            if metric_value.count != 0:
                print(
                    "There are {} matched events at {}".format(
                        metric_value.count,
                        metric_value.time_stamp
                    )
                )

Advanced scenarios

Query multiple workspaces

The same log query can be executed across multiple Log Analytics workspaces. In addition to the KQL query, the following parameters are required:

• workspace_id - The first (primary) workspace ID.
• additional_workspaces - A list of workspaces, excluding the workspace provided in the workspace_id parameter. The parameter's list items may consist of the following identifier formats:
  • Qualified workspace names
  • Workspace IDs
  • Azure resource IDs

For example, the following query executes in three workspaces:

client.query(
    <workspace_id>,
    query,
    additional_workspaces=['<workspace 2>', '<workspace 3>']
    )

A full sample can be found here.

Troubleshooting

Enable the azure.monitor.query logger to collect traces from the library.

General

Monitor Query client library will raise exceptions defined in Azure Core.

Logging

This library uses the standard logging library for logging. Basic information about HTTP sessions, such as URLs and headers, is logged at the INFO level.

Optional configuration

Optional keyword arguments can be passed in at the client and per-operation level. The azure-core reference documentation describes available configurations for retries, logging, transport protocols, and more.

Next steps

Additional documentation

For more extensive documentation, see the Azure Monitor Query documentation.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repositories using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Release History

1.0.0b3 (2021-08-09)

Features Added

• Added enum AggregationType which can be used to specify aggregations in the query API.
• Added LogsBatchQueryResult model that is returned for a logs batch query.
• Added error attribute to LogsQueryResult.

Breaking Changes

• aggregation param in the query API is renamed to aggregations
• batch_query API now returns a list of responses.
• LogsBatchResults model is now removed.
• LogsQueryRequest is renamed to LogsBatchQueryRequest
• LogsQueryResults is now renamed to LogsQueryResult
• LogsBatchQueryResult now has 4 additional attributes - tables, error, statistics and render instead of body attribute.

1.0.0b2 (2021-07-06)

Breaking Changes

• workspaces, workspace_ids, qualified_names and azure_resource_ids are now merged into a single additional_workspaces list in the query API.
• The LogQueryRequest object now takes in a workspace_id and additional_workspaces instead of workspace.
• aggregation param is now a list instead of a string in the query method.
• duration must now be provided as a timedelta instead of a string.

1.0.0b1 (2021-06-10)

Features

• Version (1.0.0b1) is the first preview of our efforts to create a user-friendly and Pythonic client library for Azure Monitor Query. For more information about this, and preview releases of other Azure SDK libraries, please visit https://azure.github.io/azure-sdk/releases/latest/python.html.
• Added ~azure.monitor.query.LogsQueryClient to query log analytics along with ~azure.monitor.query.aio.LogsQueryClient.
• Implements the ~azure.monitor.query.MetricsQueryClient for querying metrics, listing namespaces and metric definitions along with ~azure.monitor.query.aio.MetricsQueryClient.