Need help with --query parameter in Azure CLI

[Antti_Kurenniemi]

Hi all!

We've used the Az CLI sometimes to view log streams from App Service web apps. This works ok-ish, like so:

az webapp log tail --name some-demo-app --resource-group some-demo-rg

But we're pretty stuck with how to filter the results. There's a ton of stuff streamed that we're not interested, so we'd like to just filter - as in grep or whatever - the results. The documentation (az webapp log | Microsoft Docs) is... lacking, to be polite: it mentions the "--query" parameter and has a link to JMespath website, but darned if I can figure out how to use it in this case.

I understand (well, sorta) how the JMespath stuff works on JSON objects, but the "webapp log tail" returns just simple strings. How can I filter on strings on the output strings? I feel like I'm trying to do something too simple here... ;)  

Any ideas welcome!

[#2]

Have had similar issues :)
You can either use the query feature, there are some examples here albeit a bit tricky to get the syntax right:
https://docs.microsoft.com/en-us/cli/azure/query-azure-cli
Be mindful of the comment about potentially having to escape and wrapping also.
Otherwise an alternative is to pipe the output to another process and filter from there.
az webapp log tail --name some-demo-app --resource-group some-demo-rg | grep -ie 'value1' -ie 'value2'
grep or similar depending on where it is being run from.

[#3]

Thanks; I've used grep for this and it works fine, I was just wondering how to actually make use of JMESHPath - it has the "contains" function which should do the trick, but as the correct syntax is "contains(string, substring)" - I have no idea what to put in the "string" part. i.e. how to refer to the output of the tail, when it doesn't seem to be JSON...

[#4]

JMESPath example to query a name object based on a location being a specified value:
az webapp list --query "[?location=='Australia East'].name"
Adjust as needed based on what you want to look for. You can also then grep on the end of that via a pipe of course and filter the results further. Alternatives are to use diag logs and kusto (which will have a time lag to write of 5-10 mins usually) or app insights live trace. All depends on what you are trying to view. Hopefully that helps.