Log Analytics 教程Log Analytics tutorial

Log Analytics 是 Azure 门户中的工具,用于根据 Azure Monitor 日志收集的数据编辑和运行日志查询,并交互式分析其结果。Log Analytics is a tool in the Azure portal to edit and run log queries from data collected by Azure Monitor Logs and interactively analyze their results. 可以使用 Log Analytics 查询来检索符合特定条件的记录、确定趋势、分析模式,并提供对数据的各种见解。You can use Log Analytics queries to retrieve records matching particular criteria, identify trends, analyze patterns, and provide a variety of insights into your data.

本教程将介绍 Log Analytics 界面,引导你开始使用一些基本查询,并演示如何处理结果。This tutorial walks you through the Log Analytics interface, gets you started with some basic queries, and shows you how you can work with the results. 学习以下技能:You will learn the following:

  • 了解日志数据的架构Understand the log data schema
  • 编写和运行简单的查询,以及修改查询时间范围Write and run simple queries, and modify the time range for queries
  • 对查询结果进行筛选、排序和分组Filter, sort, and group query results
  • 查看、修改和共享查询结果的视觉对象View, modify, and share visuals of query results
  • 加载、导出和复制查询与结果Load, export, and copy queries and results

重要

本教程使用 Log Analytics 的功能来生成和运行查询,而不介绍查询本身。This tutorial uses features of Log Analytics to build and run a query instead of working with the query itself. 你将利用 Log Analytics 功能生成一个查询,并使用另一个示例查询。You'll leverage Log Analytics features to build one query and use another example query. 准备好学习查询的语法并开始直接编辑查询本身时,请浏览 Kusto 查询语言教程When you're ready to learn the syntax of queries and start directly editing the query itself, go through the Kusto Query Language tutorial. 本教程将介绍几个示例查询,你可以在 Log Analytics 中编辑和运行这些查询,并利用你将在本教程中学习的多个功能。That tutorial walks through several example queries that you can edit and run in Log Analytics, leveraging several of the features that you'll learn in this tutorial.

先决条件Prerequisites

本教程使用 Log Analytics 演示环境,其中包含大量支持示例查询的示例数据。This tutorial uses the Log Analytics demo environment, which includes plenty of sample data supporting the sample queries. 你也可以使用自己的 Azure 订阅,但相同的表中可能没有数据。You can also use your own Azure subscription, but you may not have data in the same tables.

打开 Log AnalyticsOpen Log Analytics

从订阅的 Azure Monitor 菜单中选择“日志”。Select Logs from the Azure Monitor menu in your subscription. 这会将初始范围设置为 Log Analytics 工作区,这意味着查询将从该工作区中的所有数据中进行选择。This will set the initial scope to a Log Analytics workspace meaning that your query will select from all data in that workspace. 如果从 Azure 资源的菜单中选择“日志”,则范围将设置为仅来自该资源的记录。If you select Logs from an Azure resource's menu, the scope is set to only records from that resource. 有关范围的详细信息,请参阅日志查询范围See Log query scope for details about the scope.

可以在屏幕左上角查看范围。You can view the scope in the top left corner of the screen. 如果使用自己的环境,则会看到一个用于选择其他范围的选项,但此选项在演示环境中不可用。If you're using your own environment, you'll see an option to select a different scope, but this option isn't available in the demo environment.

查询范围Query scope

表架构Table schema

屏幕左侧包含“表”选项卡,可用于检查当前范围内可用的表。The left side of the screen includes the Tables tab which allows you to inspect the tables that are available in the current scope. 默认情况下,按解决方案对这些表进行分组,但你可以更改其分组或对其进行筛选。These are grouped by Solution by default, but you change their grouping or filter them.

展开“日志管理”解决方案并找到 AzureActivity 表 。Expand the Log Management solution and locate the AzureActivity table. 可以展开该表以查看其架构,或将鼠标悬停在其名称上以显示有关它的其他信息。You can expand the table to view its schema, or hover over its name to show additional information about it.

表视图Tables view

单击“了解更多”,以转到记录每个表及其列的表格引用。Click Learn more to go to the table reference that documents each table and its columns. 单击“预览数据”以快速查看表中的一些近期记录。Click Preview data to have a quick look at a few recent records in the table. 这有助于在实际运行查询之前确保这是你需要的数据。This can be useful to ensure that this is the data that you're expecting before you actually run a query with it.

示例数据Sample data

编写查询Write a query

接下来,使用 AzureActivity 表编写查询。Let's go ahead and write a query using the AzureActivity table. 双击其名称以将其添加到查询窗口。Double-click its name to add it to the query window. 也可以直接在窗口中键入名称,甚至可以获取智能感知,它将帮助完成当前范围内和 KQL 命令中的表名称。You can also type directly in the window and even get intellisense that will help complete the names of tables in the current scope and KQL commands.

这是我们可以编写的最简单的查询。This is the simplest query that we can write. 它只返回表中的所有记录。It just returns all the records in a table. 通过单击“运行”按钮,或将光标置于查询文本中的任意位置并按 Shift+Enter 来运行该查询。Run it by clicking the Run button or by pressing Shift+Enter with the cursor positioned anywhere in the query text.

查询结果Query results

可以看到我们确实得到了结果。You can see that we do have results. 查询返回的记录数显示在右下角。The number of records returned by the query is displayed in the bottom right corner.

筛选器Filter

让我们向查询添加筛选器以减少返回的记录数。Let's add a filter to the query to reduce the number of records that are returned. 选择左窗格中的“筛选器”选项卡。Select the Filter tab in the left pane. 这会在查询结果中显示不同的列,可以使用这些列来筛选结果。This shows different columns in the query results that you can use to filter the results. 这些列中的顶部值将显示具有该值的记录数。The top values in those columns are displayed with the number of records with that value. 单击“CategoryValue”下的“管理”,然后单击“应用和运行” 。Click on Administrative under CategoryValue and then Apply & Run.

“查询”窗格Query pane

会将 where 语句添加到查询中,其中包含所选的值。A where statement is added to the query with the value you selected. 现在,结果仅包含具有该值的记录,因此可以看到记录数减少了。The results now include only those records with that value so you can see that the record count is reduced.

已筛选的查询结果Query results filtered

时间范围Time range

Log Analytics 工作区中的所有表都有一个名为 TimeGenerated 的列,这是创建记录的时间。All tables in a Log Analytics workspace have a column called TimeGenerated which is the time that the record was created. 所有查询都具有时间范围,该范围将结果限制为具有该范围内 TimeGenerated 值的记录。All queries have a time range that limits the results to records with a TimeGenerated value within that range. 时间范围可以在查询中设置,也可以在屏幕顶部的选择器中设置。The time range can either be set in the query or with the selector at the top of the screen.

默认情况下,查询将返回最近 24 小时的记录。By default, the query will return records form the last 24 hours. 选择“时间范围”下拉列表,并将其更改为“7 天” 。Select the Time range dropdown and change it to 7 days. 再次单击“运行”以返回结果。Click Run again to return the results. 可以看到返回了结果,但是显示了一条消息,指出我们没有看到所有结果。You can see that results are returned, but we have a message here that we're not seeing all of the results. 这是因为日志分析最多可以返回 30,000 条记录,而我们的查询返回的记录数多于此值。This is because Log Analytics can return a maximum of 30,000 records, and our query returned more records than that.

时间范围Time range

多个查询条件Multiple query conditions

让我们再添加一个筛选条件,进一步减少结果。Let's reduce our results further by adding another filter condition. 查询可以包含任意数量的筛选器,以便精确定位所需的记录集。A query can include any number of filters to target exactly the set of records that you want. 选择“ActivityStatusValue”下的“成功”,然后单击“应用和运行” 。Select Success under ActivityStatusValue and click Apply & Run.

查询结果多个筛选器Query results multiple filters

分析结果Analyze results

Log Analytics 不仅有助于编写和运行查询,还提供了用于处理结果的功能。In addition to helping you write and run queries, Log Analytics provides features for working with the results. 首先,展开记录以查看其所有列的值。Start by expanding a record to view the values for all of its columns.

展开记录Expand record

单击任意列的名称以按该列对结果进行排序。Click on the name of any column to sort the results by that column. 单击该列旁边的筛选器图标以提供筛选条件。Click on the filter icon next to it to provide a filter condition. 这类似于向查询本身添加筛选条件,但如果再次运行查询,则会清除此筛选器。This is similar to adding a filter condition to the query itself except that this filter is cleared if the query is run again. 如果要在交互式分析过程中快速分析一组记录,请使用此方法。Use this method if you want to quickly analyze a set of records as part of interactive analysis.

例如,在 CallerIpAddress 列上设置筛选器,以将记录限制于单个调用方。For example, set a filter on the CallerIpAddress column to limit the records to a single caller.

查询结果筛选器Query results filter

可以按特定列对记录进行分组,而不对结果进行筛选。Instead of filtering the results, you can group records by a particular column. 清除刚才创建的筛选器,然后打开“组列”滑块。Clear the filter that you just created and then turn on the Group columns slider.

组列Group columns

现在,将 CallerIpAddress 列拖到分组行中。Now drag the CallerIpAddress column into the grouping row. 现在,结果按该列进行组织,可以折叠每个组以帮助你进行分析。Results are now organized by that column, and you can collapse each group to help you with your analysis.

已分组的查询结果Query results grouped

使用图表Work with charts

让我们看一个查询,该查询使用可在图表中查看的数值数据。Let's have a look at a query that uses numerical data that we can view in a chart. 我们将选择一个示例查询,而不是生成查询。Instead of building a query, we'll select an example query.

在左窗格中,单击“查询”。Click on Queries in the left pane. 此窗格包含可添加到查询窗口的示例查询。This pane includes example queries that you can add to the query window. 如果使用自己的工作区,则应该具有多种类别的多个查询;但如果使用演示环境,则可能只会看到一个“Log Analytics 工作区”类别。If you're using your own workspace, you should have a variety of queries in multiple categories, but if you're using the demo environment, you may only see a single Log Analytics workspaces category. 展开此项以查看该类别的查询。Expand that to view the queries in the category.

单击名为“按 ResponseCode 的请求计数”的查询。Click on the query called Request Count by ResponseCode. 这会将查询添加到查询窗口。This will add the query to the query window. 请注意,用空白行分隔了新查询和另一个查询。Notice that the new query is separated from the other by a blank line. KQL 中的查询遇到空白行时将结束,因此它们被视为单独的查询。A query in KQL ends when it encounters a blank line, so these are seen as separate queries.

新查询New query

光标所在位置是当前的查询。The current query is the one that the cursor is positioned on. 可以看到第一个查询突出显示,表明它是当前查询。You can see that the first query is highlighted indicating it's the current query. 单击新查询中的任意位置以将其选中,然后单击“运行”按钮以运行该查询。Click anywhere in the new query to select it and then click the Run button to run it.

查询结果图表Query results chart

请注意,此输出是一个图表,而不是与上一个查询类似的表。Notice that this output is a chart instead of a table like the last query. 这是因为示例查询在末尾使用了 render 命令。That's because the example query uses a render command at the end. 请注意,有多种处理图表的选项,例如将其更改为另一种类型。Notice that there are various options for working with the chart such as changing it to another type.

尝试选择“结果”,以表的形式查看查询的输出。Try selecting Results to view the output of the query as a table.

查询结果表Query results table

后续步骤Next steps

现在,你已了解如何使用 Log Analytics,请完成有关使用日志查询的教程。Now that you know how to use Log Analytics, complete the tutorial on using log queries.