title: Azure Log Analytics workspace operations and KQL queries
agents: special
catalog: cloud/azure
license: GPLv2
distribution: third_party
description:
 Reports numeric KQL results from an Azure Monitor Logs workspace.
 Data source: the read-only Azure Monitor Logs Query API for a configured
 workspace ID. Azure Monitor Agent, data collection rules, diagnostic
 settings, or other source configuration must ingest the records separately.
 The built-in workspace_operations profile reads _LogOperation over 15 minutes
 and creates one service per workspace. Any operation Error is CRIT; otherwise
 any Warning is WARN; otherwise the service is OK.
 A custom profile returns Service and numeric Value columns, with optional
 Message. It creates one service per returned row. Shared profiles run in all
 configured workspaces; profiles nested in a workspace run only there. A
 workspace-specific profile with the same ID replaces its shared counterpart
 in that workspace, including query and levels.
 Monitored field: Value for custom KQL, or the Errors and Warnings counts
 for workspace_operations.
 State mapping: Value at or above CRIT is
 CRIT, else at or above WARN is WARN, else OK. Levels can be set in the
 profile or overridden by the Azure LA query levels rule. With no levels,
 valid custom rows remain OK. For example, a heartbeat-age profile with
 WARN 10 and CRIT 20 alerts when the last heartbeat is 10 or 20 minutes old.
 The query service also displays the supplied Message. When the agent reuses
 last successful rows after a failure, it appends the cached data age; check
 Azure LA Collector for the actual collection failure.
 A custom query should emit a stable row for each monitored source, including
 a zero when no matching events occurred. An optional Expected Service names
 list makes a missing row CRIT after a successful query, including when that
 query returned no rows at all. Without this list, an empty result causes a
 collector failure. A query error raises the collector and may reuse cached
 data; it does not create new missing-result rows. A zero count alone cannot
 confirm telemetry freshness; monitor last-record age for regular emitters.
 Metrics: azure_la_operation_errors and azure_la_operation_warnings count
 operational events; azure_la_query_value is the custom Value, with
 profile or rule levels when both are set. A synthetic missing-result service
 does not report a numeric value metric.
 Documentation: README.md and docs/profile-catalog.md in the public source repository.
item:
 Workspace ID (or configured workspace label) followed by profile ID and the
 stable Service field. The built-in item is the workspace ID or label followed
 by operations. Changing a workspace label changes discovered service names.
inventory:
 One service is discovered for each item row emitted by the special agent in
 the azure_loganalytics agent section.
