Query LogAnalytics for Azure Virtual Machine Tag?

%3CLINGO-SUB%20id%3D%22lingo-sub-1859214%22%20slang%3D%22en-US%22%3EQuery%20LogAnalytics%20for%20Azure%20Virtual%20Machine%20Tag%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1859214%22%20slang%3D%22en-US%22%3E%3CP%3Ehi!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3BI%20have%20a%20process%20that%20adds%20some%20tags%20to%20VMs%20in%20Azure.%26nbsp%3B%20I%20would%20love%20to%20query%20log%20analytics%20for%20these%20tags.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3BHere%20is%20an%20example%20of%20the%20tags%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22FoxDeploy_0-1604616556396.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F231817i627665877B19B240%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22FoxDeploy_0-1604616556396.png%22%20alt%3D%22FoxDeploy_0-1604616556396.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20found%20this%20query%20to%20parse%20VMInsights%20tags%20but%20am%20not%20sure%20where%20to%20go%20to%20look%20up%20these%20tags.%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Consolas%3B%20font-size%3A%2010.5pt%3B%20color%3A%20black%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Consolas%3B%20font-size%3A%2010.5pt%3B%20color%3A%20black%3B%22%3EInsightsMetrics%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Consolas%3B%20font-size%3A%2010.5pt%3B%22%3E%3CSPAN%20style%3D%22color%3A%20black%3B%22%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20lightslategray%3B%22%3Eextend%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20black%3B%22%3E%26nbsp%3BTags%26nbsp%3B%3D%26nbsp%3Bparse_json(Tags)%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Consolas%3B%20font-size%3A%2010.5pt%3B%22%3E%3CSPAN%20style%3D%22color%3A%20black%3B%22%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20lightslategray%3B%22%3Ewhere%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20black%3B%22%3E%26nbsp%3BTags.%5B%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20%23a31515%3B%22%3E%22AutomanagedPC%22%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20black%3B%22%3E%5D%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20blue%3B%22%3Ehas%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20black%3B%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20style%3D%22color%3A%20%23a31515%3B%22%3E%22true%22%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAny%20tips%20would%20be%20greatly%20appreciated%20%3A)%3C%2Fimg%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1859214%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ELog%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1862005%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20LogAnalytics%20for%20Azure%20Virtual%20Machine%20Tag%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1862005%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F859441%22%20target%3D%22_blank%22%3E%40FoxDeploy%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EInsightMetrics%20tags%20are%20not%20the%20ones%20you%20are%20looking%20for.%20But%20why%20are%20you%20using%20Log%20Analytics%3F%20This%20type%20of%20queries%20should%20be%20targeted%20at%20Azure%20Resource%20Graph%20instead.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERead%20the%20following%20article%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2Ffirst-query-portal%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2Ffirst-query-portal%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnd%20use%20this%20ARG%20query%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3Eresources%0A%7C%20where%20type%20%3D~%20'Microsoft.Compute%2FvirtualMachines'%0A%7C%20where%20tags.AutomanagedPC%20%3D%3D%20'true'%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20also%20use%20ARG%20via%20Az%20PowerShell%20or%20CLI%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2Foverview%23running-your-first-query%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2Foverview%23running-your-first-query%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Microsoft

hi!

 

 I have a process that adds some tags to VMs in Azure.  I would love to query log analytics for these tags. 

 

 Here is an example of the tags:

FoxDeploy_0-1604616556396.png

 

I found this query to parse VMInsights tags but am not sure where to go to look up these tags.

 

InsightsMetrics 

extend Tags = parse_json(Tags)

where Tags.["AutomanagedPC"has "true"

 

Any tips would be greatly appreciated :)

 

1 Reply

@FoxDeploy 

 

InsightMetrics tags are not the ones you are looking for. But why are you using Log Analytics? This type of queries should be targeted at Azure Resource Graph instead.

 

Read the following article: https://docs.microsoft.com/en-us/azure/governance/resource-graph/first-query-portal 

 

And use this ARG query:

 

resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| where tags.AutomanagedPC == 'true'

 

You can also use ARG via Az PowerShell or CLI: https://docs.microsoft.com/en-us/azure/governance/resource-graph/overview#running-your-first-query