Query Azure Monitor Logs and Metrics

The Azure Monitor Query SDK for Python enables programmatic access to Azure Monitor logs and metrics. It provides two client types: LogsQueryClient for querying Log Analytics workspaces using Kusto Query Language (KQL), and MetricsQueryClient for retrieving resource metrics with configurable aggregations and time granularity. The SDK supports batch queries, partial result handling, async operations, and direct conversion to pandas DataFrames for analysis.

Use this skill when you need to automate log analysis from Log Analytics workspaces, retrieve performance metrics from Azure resources, run multiple queries in batch, or integrate Azure monitoring data into Python-based analytics pipelines. It is ideal for building custom dashboards, alerting systems, or data science workflows that require Azure telemetry.

Do not use this skill if you only need ad-hoc queries through the Azure portal. This SDK is for historical query, not live event ingestion. Stop and ask for clarification if workspace IDs, resource URIs, or authentication credentials are missing.

You provide Azure credentials (via DefaultAzureCredential), a Log Analytics workspace ID or Azure resource URI, a Kusto query string or metric names, and a time range (as timedelta or datetime tuple). For metrics, you can specify aggregation types (average, maximum, minimum, count), granularity intervals, and dimension filters.

You receive structured response objects containing tables with rows and columns for logs, or metric objects with time-series data points. Responses include status indicators for partial or failed queries, and can be converted directly to pandas DataFrames.

The SDK integrates with Azure Identity for authentication using DefaultAzureCredential, pandas for DataFrame conversion and data analysis, and Azure Monitor services including Log Analytics workspaces and Azure Monitor metrics for any Azure resource. It supports both synchronous and asynchronous client patterns through azure.monitor.query.aio.

This skill serves DevOps engineers automating infrastructure monitoring, data analysts building custom reporting on Azure telemetry, SREs creating alerting pipelines, and Python developers integrating Azure observability into applications. It differs from portal-based querying by enabling programmatic access, batch operations, and integration into automated workflows.

Installation and basic usage

pip install azure-monitor-query

from azure.monitor.query import LogsQueryClient
from datetime import timedelta

client = LogsQueryClient(credential)

query = """
AppRequests
| where TimeGenerated > ago(1h)
| summarize count() by bin(TimeGenerated, 5m), ResultCode
| order by TimeGenerated desc
"""

response = client.query_workspace(
    workspace_id=os.environ["AZURE_LOG_ANALYTICS_WORKSPACE_ID"],
    query=query,
    timespan=timedelta(hours=1)
)

for table in response.tables:
    for row in table.rows:
        print(row)

Environment setup

### Log Analytics
AZURE_LOG_ANALYTICS_WORKSPACE_ID=<workspace-id>

### Metrics
AZURE_METRICS_RESOURCE_URI=/subscriptions/<sub>/resourceGroups/<rg>/providers/<provider>/<type>/<name>