Azure Monitor 日志概览Azure Monitor Logs overview

Azure Monitor 日志是 Azure Monitor 的一项功能,用于从受监视的资源收集并整理日志和性能数据。Azure Monitor Logs is a feature of Azure Monitor that collects and organizes log and performance data from monitored resources. 来自不同源的数据(例如来自 Azure 服务的平台日志、来自虚拟机代理的日志和性能数据以及来自应用程序的使用情况和性能数据)可以合并到一个工作区中,以便使用一种能够快速分析数百万条记录的复杂查询语言对这些数据进行集中分析。Data from different sources such as platform logs from Azure services, log and performance data from virtual machines agents, and usage and performance data from applications can be consolidated into a single workspace so they can be analyzed together using a sophisticated query language that's capable of quickly analyzing millions of records. 你可以执行仅检索特定记录集的简单查询,也可以执行复杂的数据分析来识别监视数据中的关键模式。You may perform a simple query that just retrieves a specific set of records or perform sophisticated data analysis to identify critical patterns in your monitoring data. 通过 Log Analytics 以交互方式使用日志查询及其结果,在警报规则中使用它们来主动接收问题通知,或在工作簿或仪表板中将其结果可视化。Work with log queries and their results interactively using Log Analytics, use them in an alert rules to br proactively notified of issues, or visualize their results in a workbook or dashboard.

备注

Azure Monitor 日志是支持 Azure Monitor 的数据平台的一半。Azure Monitor Logs is one half of the data platform supporting Azure Monitor. 另一半则是将数值数据存储在时序数据库中的 Azure Monitor 指标The other is Azure Monitor Metrics which stores numeric data in a time-series database. 它使得这些数据比 Azure Monitor 日志中的数据更为轻量,并且能够支持准实时方案,因此特别适用于对问题发出警报并快速进行检测。This makes this data more lightweight than data in Azure Monitor Logs and capable of supporting near real-time scenarios making them particularly useful for alerting and fast detection of issues. 不过,指标只能将数值数据存储在特定的结构中,而日志可以存储各种不同的数据类型,每个数据类型都有自己的结构。Metrics though can only store numeric data in a particular structure, while Logs can store a variety of different data types each with their own structure. 还可使用日志查询对日志数据执行复杂的分析,只是无法分析指标数据。You can also perform complex analysis on Logs data using log queries which cannot be used for analysis of Metrics data.

可以对 Azure Monitor 日志执行哪些操作?What can you do with Azure Monitor Logs?

下表介绍了 Azure Monitor 中的日志的不同使用方式:The following table describes some of the different ways that you can use Logs in Azure Monitor:

分析Analyze 使用 Azure 门户中的 Log Analytics 可以编写日志查询,并通过强大的分析引擎以交互方式分析日志数据Use Log Analytics in the Azure portal to write log queries and interactively analyze log data using a powerful analysis engine
AlertAlert 配置日志警报规则,以便在查询结果与特定的结果匹配时发送通知或执行自动化操作Configure a log alert rule that sends a notification or takes automated action when the results of the query match a particular result.
可视化Visualize 将以表格或图表形式呈现的查询结果固定到 Azure 仪表板Pin query results rendered as tables or charts to an Azure dashboard.
创建一个工作簿以与交互式报表中的多组数据合并。Create a workbook to combine with multiple sets of data in an interactive report.
将查询结果导出到 Power BI,以使用不同的可视化效果并与 Azure 外部的用户共享。Export the results of a query to Power BI to use different visualizations and share with users outside of Azure.
将查询结果导出到 Grafana 以利用其仪表板并与其他数据源合并。Export the results of a query to Grafana to leverage its dashboarding and combine with other data sources.
InsightsInsights 支持为特定应用程序和服务提供自定义监视体验的见解Support insights that provide a customized monitoring experience for particular applications and services.
检索Retrieve 使用 Azure CLI 从命令行访问日志查询结果。Access log query results from a command line using Azure CLI.
使用 PowerShell cmdlet 从命令行访问日志查询结果。Access log query results from a command line using PowerShell cmdlets.
使用 REST API 从自定义应用程序访问日志查询结果。Access log query results from a custom application using REST API.
导出Export 将日志数据配置为自动导出到 Azure 存储帐户或 Azure 事件中心。Configure automated export of log data to Azure storage account or Azure Event Hubs.
构建一个工作流来检索日志数据,并使用逻辑应用将其复制到外部位置。Build a workflow to retrieve log data and copy it to an external location using Logic Apps.

日志概述

数据收集Data collection

创建 Log Analytics 工作区后,必须配置不同的源以发送其数据。Once you create a Log Analytics workspace, you must configure different sources to send their data. 系统不自动收集任何数据。No data is collected automatically. 此配置将因数据源而异。This configuration will be different depending on the data source. 例如,创建诊断设置,以将资源日志从 Azure 资源发送到工作区。For example, create diagnostic settings to send resource logs from Azure resources to the workspace. 配置工作区上的数据源,以收集其他事件和性能数据。Configure data sources on the workspace to collect additional events and performance data.

Log Analytics 工作区Log Analytics workspaces

Azure Monitor 日志收集的数据存储在一个或多个 Log Analytics 工作区中。Data collected by Azure Monitor Logs is stored in one more Log Analytics workspaces. 工作区定义数据的地理位置、访问权限(定义哪些用户可以访问数据),以及配置设置(例如定价层和数据保留)。The workspace defines the geographic location of the data, access rights defining which users can access data, and configuration settings such as the pricing tier and data retention.

必须创建至少一个工作区才能使用 Azure Monitor 日志。You must create at least one workspace to use Azure Monitor Logs. 可以对所有监视数据使用一个工作区,也可以根据需要选择创建多个工作区。A single workspace may be sufficient for all of your monitoring data, or may choose to create multiple workspaces depending on your requirements. 例如,你可以对生产数据使用一个工作区,对测试数据使用另一个工作区。For example, you might have one workspace for your production data and another for testing.

数据结构Data structure

日志查询从 Log Analytics 工作区检索其数据。Log queries retrieve their data from a Log Analytics workspace. 每个工作区都包含多个表,这些表被组织成具有多行数据的单独列。Each workspace contains multiple tables are that are organized into separate columns with multiple rows of data. 每个表由一组唯一的列定义,这些列由数据源提供的数据行共享。Each table is defined by a unique set of columns that are shared by the rows of data provided by the data source.

Azure Monitor 日志结构Azure Monitor Logs structure

来自 Application Insights 的日志数据也存储在 Azure Monitor 日志中,但根据应用程序的配置方式不同,存储的方式也不同。Log data from Application Insights is also stored in Azure Monitor Logs, but it's stored different depending on how your application is configured. 对于基于工作区的应用程序,数据存储在 Log Analytics 工作区中的一组标准表中,以保存诸如应用程序请求、异常和页面视图之类的数据。For a workspace-based application, data is stored in a Log Analytics workspace in a standard set of tables to hold data such as application requests, exceptions, and page views. 多个应用程序可以使用同一个工作区。Multiple applications can use the same workspace. 对于经典应用程序,数据不会存储在 Log Analytics 工作区中。For a classic application, the data is not stored in a Log Analytics workspace. 它使用相同的查询语言,并且你可以在 Azure 门户中使用相同的 Log Analytics 工具创建和运行查询。It uses the same query language, and you create and run queries using the same Log Analytics tool in the Azure portal. 不过,经典应用程序的数据是分开存储的。Data for classic applications though is stored separately from each other. 尽管表名和列名不同,但其常规结构与基于工作区的应用程序相同。Its general structure is the same as workspace-based applications although the table and column names are different. 有关基于工作区的应用程序和经典应用程序的架构的详细比较,请参阅基于工作区的资源更改See Workspace-based resource changes for a detailed comparison of the schema for workspace-based and classic applications.

备注

我们仍然针对 Application Insights 体验中的 Application Insights 经典资源查询、工作簿和基于日志的警报提供完全的后向兼容性。We still provide full backwards compatibility for your Application Insights classic resource queries, workbooks, and log-based alerts within the Application Insights experience. 若要根据新的基于工作区的表结构/架构进行查询/查看,必须先导航到 Log Analytics 工作区。To query/view against the new workspace-based table structure/schema you must first navigate to your Log Analytics workspace. 在预览版期间,从 Application Insights 窗格中选择“日志”即可访问经典 Application Insights 查询体验。During the preview, selecting Logs from within the Application Insights panes will give you access to the classic Application Insights query experience. 有关更多详细信息,请参阅查询范围See Query scope for more details.

Application Insights 的 Azure Monitor 日志结构Azure Monitor Logs structure for Application Insights

日志查询Log queries

可使用日志查询从 Log Analytics 工作区检索数据,该查询是对处理数据和返回结果的只读请求。Data is retrieved from a Log Analytics workspace using a log query which is a read-only request to process data and return results. 日志查询采用 Kusto 查询语言 (KQL) 编写,这种语言是 Azure 数据资源管理器使用的查询语言。Log queries are written in Kusto Query Language (KQL), which is the same query language used by Azure Data Explorer. 你可以在 Log Analytics 中编写日志查询,以交互方式分析其结果,在警报规则中使用它们来主动接收问题通知,或将其结果包含在工作簿或仪表板中。You can write log queries in Log Analytics to interactively analyze their results, use them in alert rules to be proactively notified of issues, or include their results in workbooks or dashboards. Insights 包括预生成的查询,以支持其视图和工作簿。Insights include prebuilt queries to support their views and workbooks.

Log Analytics

Log AnalyticsLog Analytics

使用 Log Analytics(Azure 门户中的工具)编辑和运行日志查询并以交互方式分析其结果。Use Log Analytics, which is a tool in the Azure portal, to edit and run log queries and interactively analyze their results. 然后,你可以使用你创建的查询来支持 Azure Monitor 中的其他功能,例如日志查询警报和工作簿。You can then use the queries that you create to support other features in Azure Monitor such as log query alerts and workbooks. 通过 Azure Monitor 菜单中的“日志”选项或 Azure 门户中的大多数其他服务访问 Log Analytics。Access Log Analytics from the Logs option in the Azure Monitor menu or from most other services in the Azure portal.

与 Azure 数据资源管理器的关系Relationship to Azure Data Explorer

Azure Monitor 日志基于 Azure 数据资源管理器。Azure Monitor Logs is based on Azure Data Explorer. Log Analytics 工作区大致相当于 Azure 数据资源管理器中的数据库,表的结构相同,并且都使用相同的 Kusto 查询语言 (KQL)。A Log Analytics workspace is roughly the equivalent of a database in Azure Data Explorer, tables are structured the same, and both use the same Kusto Query Language (KQL). 在 Azure 门户中使用 Log Analytics 来处理 Azure Monitor 查询的体验与使用 Azure 数据资源管理器 Web UI 的体验类似。The experience of using Log Analytics to work with Azure Monitor queries in the Azure portal is similar to the experience using the Azure Data Explorer Web UI. 你甚至可以将来自 Log Analytics 工作区的数据包含在 Azure 数据资源管理器查询中You can even include data from a Log Analytics workspace in an Azure Data Explorer query.

后续步骤Next steps