Azure Monitor 日志查询中的 workspace() 表达式workspace() expression in Azure Monitor log query

workspace 表达式用于 Azure Monitor 查询中，以从同一资源组、另一个资源组或另一个订阅的特定工作区中检索数据。The workspace expression is used in an Azure Monitor query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. 此表达式适用于在 Log Analytics 查询中包含日志数据以及在日志查询中在多个工作区上查询数据。This is useful to include log data in an Application Insights query and to query data across multiple workspaces in a log query.

语法Syntax

workspace(标识符)workspace(Identifier)

参数Arguments

  • 标识符：使用下表中的某种格式标识工作区。Identifier: Identifies the workspace using one of the formats in the table below.
标识符Identifier 说明Description 示例Example
资源名称Resource Name 人工可读的工作区名称（又称“组件名称”）Human readable name of the workspace (AKA "component name") workspace("contosoretail")workspace("contosoretail")
限定的名称Qualified Name 窗体中工作区的完整名称：“subscriptionName/resourceGroup/componentName”Full name of the workspace in the form: "subscriptionName/resourceGroup/componentName" workspace('Contoso/ContosoResource/ContosoWorkspace')workspace('Contoso/ContosoResource/ContosoWorkspace')
IDID 工作区 GUIDGUID of the workspace workspace("b438b3f6-912a-46d5-9db1-b42069242ab4")workspace("b438b3f6-912a-46d5-9db1-b42069242ab4")
Azure 资源 IDAzure Resource ID Azure 资源的标识符Identifier for the Azure resource workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail")workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail")

备注Notes

  • 你必须具有该工作区的读取权限。You must have read access to the workspace.
  • 相关的表达式是 app，可以在 Application Insights 应用程序上进行查询。A related expression is app that allows you to query across Application Insights applications.

示例Examples

workspace("contosoretail").Update | count

workspace("b438b4f6-912a-46d5-9cb1-b44069212ab4").Update | count

workspace("/subscriptions/e427267-5645-4c4e-9c67-3b84b59a6982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count

union 
(workspace("myworkspace").Heartbeat | where Computer contains "Con"),
(app("myapplication").requests | where cloud_RoleInstance contains "Con")
| count  

union 
(workspace("myworkspace").Heartbeat), (app("myapplication").requests)
| where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))

后续步骤Next steps