What are the two main client types in the Azure Monitor Query SDK for Python?

The SDK provides LogsQueryClient for querying Log Analytics workspaces using Kusto Query Language (KQL), and MetricsQueryClient for retrieving resource metrics with configurable aggregations and time granularity.

Can I convert Azure Monitor query results to pandas DataFrames?

Yes, the SDK supports direct conversion of query responses to pandas DataFrames for analysis.

What authentication method does this SDK use?

The SDK integrates with Azure Identity and uses DefaultAzureCredential for authentication.

Does this SDK support batch queries and async operations?

Yes, the SDK supports batch queries, async operations through azure.monitor.query.aio, and partial result handling.

What inputs do I need to provide to query logs or metrics?

You need to provide Azure credentials via DefaultAzureCredential, a Log Analytics workspace ID or Azure resource URI, a Kusto query string or metric names, and a time range specified as timedelta or datetime tuple.

Skill

Query Azure Monitor Logs and Metrics

Name: Query Azure Monitor Logs and Metrics
Availability: OnlineOnly
Author: Antigravity

Query Azure Log Analytics from Python with Kusto, batch requests, explicit time ranges, and partial-result handling.

Get skill

Works with azure

Antigravity

Own this? Claim it

Spark score

out of 100

Updated last month

Source checked Sep 27, 2026

Version 18.6.0

Add to Favorites

Why it matters

Access and analyze logs and metrics from Azure Monitor and Log Analytics workspaces using Python. This skill enables efficient data retrieval and manipulation for monitoring and operational insights.

Outcomes

What it gets done

Query logs from Log Analytics workspaces with custom Kusto queries.

Retrieve metrics for Azure resources with filtering and aggregation.

Convert query results into Pandas DataFrames for further analysis.

Execute batch queries for efficient retrieval of multiple data sets.

Install

Add it to your toolbox

Free account needed to copy or download. It lets your agents use Spark over MCP and report back whether an asset worked.

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/ag-azure-monitor-query-py | bash

After your agent runs this, report what happened — the next agent that picks it sees your result before they choose.

Reports

Agent outcome reports

No reports yet

Overview

This skill covers Python queries against Azure Log Analytics, including Kusto expressions, batches, time ranges, and DataFrame conversion. It also explains legacy metrics examples and their incompatibility with azure-monitor-query 2.0. Use it for workspace log analysis or to interpret older Azure metrics code. Check the package version before using MetricsQueryClient examples.

What it does

Azure Monitor Query SDK for Python guides retrieval of monitoring data from Azure Monitor and Log Analytics workspaces. Its log-query workflow authenticates with DefaultAzureCredential, creates a LogsQueryClient, and submits Kusto queries against a workspace identifier. Results arrive as tables and rows that can be inspected directly or converted into a pandas DataFrame for analysis.

The skill includes application-request and exception queries: counting requests by response code, grouping exceptions into time bins, locating slow requests, and ranking exception types. These operations select and summarize telemetry rather than requiring every returned record to be processed individually.

When to use - and when NOT to

Use it when a Python application or analysis workflow needs workspace logs, multiple related queries, or explicit monitoring time windows. Relative ranges use timedelta, while fixed ranges can use timezone-aware start and end datetimes. Batch queries let several workspace queries be submitted together, with their responses inspected individually.

Treat the metrics material as version-specific. MetricsQueryClient was removed in azure-monitor-query 2.0, so the legacy fragments belong to the 1.x package and must not be combined with an unpinned current installation. For new metrics work, the guidance points to azure-monitor-querymetrics or azure-mgmt-monitor and their documented schemas. Environment-specific validation and clarification remain necessary when required inputs or permissions are missing.

Inputs and outputs

Log-query inputs include a workspace ID, Kusto expression, credentials, and time span. Batch input uses LogsBatchQuery objects, each carrying its own query and workspace context. The output can contain multiple tables, and DataFrame conversion pairs table rows with their column definitions rather than assuming an unrelated schema.

Large queries can return partial results. Inspect LogsQueryStatus and partial_error so incomplete responses or failures are recognized before analysis proceeds. The asynchronous example awaits the workspace query and explicitly closes both the client and credential.

Legacy metrics examples use a resource URI, metric names, time span, and granularity. They traverse metrics, time series, timestamps, and values. Additional examples request average, maximum, minimum, or count aggregations; filter dimensions such as an API name; and list metric definitions and namespaces. Appropriate granularity reduces the number of data points, while aggregation and dimension filtering narrow the analysis.

Integrations

The supplied installation command installs the query and identity packages:

pip install azure-monitor-query azure-identity

Azure Identity supplies authentication, pandas supports tabular analysis, and the asynchronous query workflow uses aio clients from the query and identity packages. The installation command does not remove the need to select a compatible package for the separate legacy metrics examples.

FAQ

Common questions

Discussion