A function is a log query in Azure Monitor that can be used in other log queries as though it's a command. Functions allow developers to provide solutions to different customers and for you to reuse query logic in your own environment. We have upgraded the functions experience in Log Analytics, providing new UI and capabilities to allow you to do more with functions.
Log Analytics supports the following types of functions:
Solution function:Pre-built functions included with Azure Monitor. These are available in all Log Analytics workspaces and can't be modified.
Workspace functions:Functions installed in a particular Log Analytics workspace and can be modified and controlled by the user
The new Functions experience
Discover functions in the sidebar
Functions are now a part of Log Analytics sidebar. As any other Log Analytics sidebar, functions are searchable, filterable and you can group the functions tree according to the function's metadata:
You may also set your own favorite functions per workspace for quicker access.
Functions have a popover with additional data, including parameters defined for the function:
Use functions in your queries with intellisense
Functions are integrated with Log Analytics intellisense. Intellisense supports auto complete for functions and will also assist with the defined parameters per function:
Workspace functions were upgraded and they now support parameters and default parameter values.
You can create and save your own workspace functions per Log Analytics workspace. Compose your query with parameters and use the "save" ->"Save as function" to define your own workspace functions in LA.
Note: you must have sufficient workspace permissions to save a function.
Edit and mange your functions
Once a function is saved, you can still edit and mange it. Load the function's code to an empty Log Analytics tab to change the function's code or it's metadata.
Functions are a great way to do more with Log Analytics. Use our solution functions or define your own functions to re-use logic and queries and shorten your way to insight.