Azure logging with Azure Monitor, Log Analytics, and KQL

Separate activity, resource, and application logs, configure their collection paths, and query Azure telemetry without confusing retention or integration boundaries.

Guance Editorial Team 2026-10-27 5 min read Updated 2026-10-27

Best practices

Illustration of application infrastructure and operations

Azure Monitor brings several kinds of telemetry together, but they do not all arrive in a Log Analytics workspace automatically. Activity logs describe control-plane operations, resource logs describe supported resource activity, and application telemetry describes code-level behavior.

Choose the collection and export path for each source before treating the workspace as a complete record of the system.

Documentation reviewed October 27, 2026. Examples are illustrative; cloud deployment, delivery, and cost tests were not performed for this article.

Understand the log sources

Source	What it covers	Collection requirements
Activity Log	Subscription-level control-plane events	Generated automatically; configure export when you need workspace queries or longer retention
Resource logs	Service-specific operational records, such as Key Vault audit events	Usually require diagnostic settings for supported categories and destinations
Application telemetry	Requests, dependencies, exceptions, traces, or application output	Requires supported instrumentation or platform-specific logging configuration

Resource-log collection is a common gap. For resources that use diagnostic settings, select the relevant categories and destination explicitly. Not every logging feature uses that mechanism: network flow logs have their own Network Watcher configuration. NSG flow logs are on a retirement path, with virtual network flow logs the replacement; do not treat them as a generic diagnostic-setting category.

Route supported logs with diagnostic settings

A diagnostic setting can send selected data to:

Log Analytics: query and analyze supported tables and configure alerts.
Storage: retain exported data with an appropriate lifecycle and access policy.
Event Hubs: stream data to a consumer that implements the required ingestion and transformation flow.

Verify the resource's supported categories and destination constraints. A configured Event Hub is an export path, not proof that a third-party platform is already consuming and parsing the stream.

Start querying with KQL

For workspace-based Application Insights log messages, query AppTraces. Despite the name, these records are application trace messages, not a table containing every distributed-tracing span:

// Error and critical traces from the last hour
AppTraces
| where TimeGenerated > ago(1h)
| where SeverityLevel >= 3
| project TimeGenerated, Message, Properties
| order by TimeGenerated desc

To chart the count in five-minute buckets:

AppTraces
| where TimeGenerated > ago(1h)
| where SeverityLevel >= 3
| summarize count() by bin(TimeGenerated, 5m)
| render timechart

KQL passes results through operators separated by |: where filters, summarize aggregates, render visualizes, and join correlates. Table and column names depend on the query context. For example, Application Insights' application-oriented schema uses names such as traces and operation_Id, while workspace tables use names such as AppTraces and OperationId.

Instrument the application

Azure Monitor Application Insights is the application performance monitoring part of Azure Monitor. Workspace-based resources store telemetry in Log Analytics; Application Insights provides the application investigation experience on top of that data.

Use a supported Application Insights SDK, OpenTelemetry distribution, or platform instrumentation option for your stack. Follow Microsoft's current language-specific instrumentation guidance: the recommended distribution and supported features vary by language. Automatic request, dependency, and exception collection varies by runtime and configuration; custom trace logs may need additional integration.

Correlation also depends on context propagation and instrumentation. Do not assume every record carries a usable operation identifier. On supported App Service configurations, web-server and application logging are additional options, with capabilities differing by operating system and runtime.

Control retention and cost

Costs depend on ingestion, table plan, retention, queries, and any export destinations. Do not assume one workspace-wide price or retention period applies to every table. Microsoft documents total retention options up to 12 years for supported configurations, but interactive retention, long-term retention, and plan constraints differ.

Collect only categories you need, configure table retention deliberately, and estimate storage/export/retrieval costs for archival workflows. Storage may suit an archive, but there is no universal order-of-magnitude saving to promise.

Collect application files from Azure VMs

For application logs written to a VM filesystem, configure Guance DataKit log collection with the real file paths and read permissions. This collects those files; it does not automatically import all data in Log Analytics.

Write a test record with a timestamp, level, and request identifier. Confirm it appears at the collector and in the log viewer, then verify JSON parsing, timestamp interpretation, severity mapping, and handling of sensitive fields. A request identifier helps searching; trace navigation also requires matching trace data and field configuration.

Frequently asked questions

Why are resource logs missing?

For supported resource categories, verify diagnostic settings, permissions, destination health, and ingestion delay. For special sources such as network flow logs, follow their own configuration path. Enable and validate the sources needed for an investigation rather than assuming all resource events are collected by default.

Is KQL difficult to learn?

Filtering and aggregation concepts transfer from SQL, though the syntax and execution model differ. Start with where, summarize, time filters, and render, then add joins when the data model calls for them.

How do Application Insights and Log Analytics relate?

Application Insights supplies application performance monitoring capabilities. Workspace-based resources store their telemetry in a Log Analytics workspace, where tables such as AppTraces, AppRequests, and AppExceptions can be queried with KQL.

How should logs from multiple clouds be unified?

Verify the export and receiver for each source, including permissions, retries, and parsing. Normalize time, service, and environment fields after establishing delivery. Host file collection and managed-service exports are different pipelines.