View and query Log Analytics with Kibana and Azure Data Explorer

Copper Contributor

Jun 26, 2021

Hi,

thanks for the article.

I've created the DataExplorer, the function to connect the LogAnalytics cluser, the service principal to grant access to elastic search and succesfully deployed the containers on my Azure Aks.

Kibana can see the DataExplorer cluster and is also listing the functions that I have created to map the LogAnalytics tables.

I am stuck at the point where Kibana can't find the time field even if the table I am trying to import does contain it with the correct data type (DateTime).

I have also tried to import the index definition manually through a Json

[
  {
    "_id": "kubeventsindex",
    "_type": "index-pattern",
    "_source": {
      "title": "DBNAME:LogAnalytics_KubeEvents",
      "timeFieldName": "TimeGenerated",
      "fields": "[{\"name\":\"Message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"TimeGenerated\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]"
    }
  }
]

Kibana creates the index correctly

but then the query crashes with this message:

It looks like an missing authorization, but I can't see where to add this authorization.

Do I also need to add the scope of the LogAnalytics to the service principal I use to access the DataExplorer ?

thanks

Marco

Blog Post

View and query Log Analytics with Kibana and Azure Data Explorer