{"id":23557966,"url":"https://github.com/meken/azure-log-analytics-metadata","last_synced_at":"2025-07-26T10:15:02.262Z","repository":{"id":163557158,"uuid":"319690175","full_name":"meken/azure-log-analytics-metadata","owner":"meken","description":"Retrieving metadata from an Azure Monitor Log Analytics workspace","archived":false,"fork":false,"pushed_at":"2021-03-26T14:03:11.000Z","size":6,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-16T00:41:48.047Z","etag":null,"topics":["az-cli","azure","azure-monitor","log-analytics"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/meken.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-12-08T16:04:04.000Z","updated_at":"2021-03-26T14:03:14.000Z","dependencies_parsed_at":null,"dependency_job_id":"8557fe72-758f-4609-9cd2-9bd564dc3bf3","html_url":"https://github.com/meken/azure-log-analytics-metadata","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/meken/azure-log-analytics-metadata","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meken%2Fazure-log-analytics-metadata","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meken%2Fazure-log-analytics-metadata/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meken%2Fazure-log-analytics-metadata/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meken%2Fazure-log-analytics-metadata/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/meken","download_url":"https://codeload.github.com/meken/azure-log-analytics-metadata/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meken%2Fazure-log-analytics-metadata/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267149768,"owners_count":24043461,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-26T02:00:08.937Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["az-cli","azure","azure-monitor","log-analytics"],"created_at":"2024-12-26T15:19:06.537Z","updated_at":"2025-07-26T10:15:02.256Z","avatar_url":"https://github.com/meken.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Accessing table metadata with Log Analytics\n\n[Azure Log Analytics](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-platform-logs) is a tool in the Azure portal to edit and run log queries from data collected by Azure Monitor Logs and interactively analyze their results. These logs are typically stored in a tabular format and queried through a language called [Kusto Query Language (KQL)](https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/).\n\nAlthough the Azure portal provides the schema information in a visual way, sometimes you'd like to have programmatic access to this information. KQL provides schema management operations to get metadata information through the [`.show table schema` command](https://docs.microsoft.com/en-us/azure/data-explorer/kusto/management/show-table-schema-command), however, this and other KQL management commands are not available in Log Analytics context. In this document we'll explore the alternative options.\n\nBefore we start exploring various options, make sure that you've captured the Log Analytics Workspace id for your experiments. In the examples below we'll be using the `ADFActivityRun` table which would only be present if you've configured an Azure Data Factory to send its diagnostics to the workspace. You can replace that with any other table you'd like (for example the more general `AzureMetrics`). In this document an example will be provided to get the list of available tables within a workspace too.\n\n```bash\nWORKSPACE_ID=\"...\"  # Log Analytics workspace id\n```\n\n## Naive approach\n\nThe first option that you could try is the Azure CLI command [`az monitor log-analytics`](https://docs.microsoft.com/en-us/cli/azure/ext/log-analytics/monitor/log-analytics?view=azure-cli-latest) (which is at the moment of this writing in preview), that runs a Log Analytics query.\n\n```bash\n$ az monitor log-analytics query -w $WORKSPACE_ID \\\n    --analytics-query \"ADFActivityRun | limit 1\" \\\n    --query \"keys([0])\" -o tsv\nTableName\nTenantId\nSourceSystem\nTimeGenerated\nResourceId\nOperationName\n...\n```\n\nThis is a very simple method that would provide at least the column names for a table. However, the column types are not available and it wouldn't work if you had an empty table either.\n\n## REST to rescue\n\nAll Azure services have well documented REST APIs, this applies to [Log Analytics Workspaces](https://docs.microsoft.com/en-us/rest/api/loganalytics/dataaccess/metadata/get) too. We could just run `curl` (or a similar tool) to get the relevant information. But, we'd then have to deal with the authentication and all, luckily Azure CLI provides the [rest](https://docs.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest#az_rest) command which uses the same identity as the CLI user to make the web request, simplifying things.\n\n```bash\n$ az rest -u https://api.loganalytics.io/v1/workspaces/$WORKSPACE_ID/metadata \\\n    --query \"tables[?name=='ADFActivityRun'].columns[].[name, type]\" -o tsv\nTenantId        string\nSourceSystem    string\nTimeGenerated   datetime\nResourceId      string\nOperationName   string\n...\n```\n\n### And the tables?\n\nIf you don't know the name of the table that you're looking for, you could also retrieve that information through this same method.\n\n```bash\n$ az rest -u https://api.loganalytics.io/v1/workspaces/$WORKSPACE_ID/metadata \\\n    --query \"tables[].name\" -o tsv\nAADDomainServicesAccountLogon\nAADDomainServicesAccountManagement\nAADDomainServicesDirectoryServiceAccess\nAADDomainServicesLogonLogoff\n...\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeken%2Fazure-log-analytics-metadata","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmeken%2Fazure-log-analytics-metadata","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeken%2Fazure-log-analytics-metadata/lists"}