Azure Monitor 日志查询中的 workspace() 表达式workspace() expression in Azure Monitor log query
workspace
表达式用于 Azure Monitor 查询中,以从同一资源组、另一个资源组或另一个订阅的特定工作区中检索数据。The workspace
expression is used in an Azure Monitor query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. 此表达式适用于在 Log Analytics 查询中包含日志数据以及在日志查询中在多个工作区上查询数据。This is useful to include log data in an Application Insights query and to query data across multiple workspaces in a log query.
语法Syntax
workspace(
标识符)
workspace(
Identifier)
参数Arguments
- 标识符:使用下表中的某种格式标识工作区。Identifier: Identifies the workspace using one of the formats in the table below.
标识符Identifier | 说明Description | 示例Example |
---|---|---|
资源名称Resource Name | 人工可读的工作区名称(又称“组件名称”)Human readable name of the workspace (AKA "component name") | workspace("contosoretail")workspace("contosoretail") |
限定的名称Qualified Name | 窗体中工作区的完整名称:“subscriptionName/resourceGroup/componentName”Full name of the workspace in the form: "subscriptionName/resourceGroup/componentName" | workspace('Contoso/ContosoResource/ContosoWorkspace')workspace('Contoso/ContosoResource/ContosoWorkspace') |
IDID | 工作区 GUIDGUID of the workspace | workspace("b438b3f6-912a-46d5-9db1-b42069242ab4")workspace("b438b3f6-912a-46d5-9db1-b42069242ab4") |
Azure 资源 IDAzure Resource ID | Azure 资源的标识符Identifier for the Azure resource | workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail")workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail") |
备注Notes
- 你必须具有该工作区的读取权限。You must have read access to the workspace.
- 相关的表达式是
app
,可以在 Application Insights 应用程序上进行查询。A related expression isapp
that allows you to query across Application Insights applications.
示例Examples
workspace("contosoretail").Update | count
workspace("b438b4f6-912a-46d5-9cb1-b44069212ab4").Update | count
workspace("/subscriptions/e427267-5645-4c4e-9c67-3b84b59a6982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count
union
(workspace("myworkspace").Heartbeat | where Computer contains "Con"),
(app("myapplication").requests | where cloud_RoleInstance contains "Con")
| count
union
(workspace("myworkspace").Heartbeat), (app("myapplication").requests)
| where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))
后续步骤Next steps
- 参阅应用表达式来引用 Application Insights 应用。See the app expression to refer to an Application Insights app.
- 了解 Azure Monitor 数据是如何存储的。Read about how Azure Monitor data is stored.
- 访问有关 Kusto 查询语言的完整文档。Access full documentation for the Kusto query language.