Log Analytics Workspace
What it is
A Log Analytics workspace (LAW) is a dedicated container that stores logs (diagnostic data, activity log exports, Application Insights, custom telemetry) in a structured, queryable format. It is the log store of Azure Monitor, queried with the KQL language.
Why it exists
Metrics are great for numeric trends, but many signals are relational/text/event data — error messages, audit trails, slow queries — that you need to combine and search across. A workspace gives a central place to ingest, retain, and richly query log data.
Key ideas
- Tables hold typed data (e.g.
VMComputer,Heartbeat,AzureActivity,Perf); data lands with defined schemas. - Ingestion via diagnostics settings: send VM guest logs, activity log export, app logs to the workspace.
- Query with KQL (
| where,| summarize,| join,| render). - Retention (default 30-31 days for Pay-as-you-go; can extend to years) and interactive vs long-term retention buckets.
- Supports log-based alerts (schedule a KQL rule), workbooks, and dashboards.
- Each workspace is tied to a region and can collect from many subscriptions/resources.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: azure-monitor/logs/log-analytics-overview
Exam notes
- Diagnostics settings define which logs/metrics stream where (LAW, storage, event hub).
- Know common tables for the exam:
AzureActivity(activity log),Perf/VMComputer(VM performance/logs via agent),Heartbeat. - Log alert = scheduled KQL query that triggers when results match; distinct from metric alerts.
- Workspace needs an agent/DIAG setting configured to actually receive data — data isn’t collected by default.
Related
kql · azure-monitor · azure-monitor-activity-log · workbooks · metric-alert · Home
📘 Source: Microsoft Learn — Log Analytics