Azure Log Analytics: Looking at data and costs

This post has been republished via RSS; it originally appeared at: MSDN Blogs.

At some stage, you either need to add a new set of data to Log Analytics or even look at your usage and costs.

Originally you looked at the Usage table for this data.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/log-standard-properties 

and

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-cost-storage


As you can see from these docs (and please read them as I wont go over the content here), Usage and some of the queries have moved to a new method using Union .


Here are a few of my own that use this new technique.


In this first example I take the sum of all bytes sent to all solutions.  I have commented out the _IsBillable line as I wanted to show both data types. 

A customer this week asked which solutions were free, this shows you that detail (after you have collected some data of course). 

However if you don't have the data, you can do a check within the public Demo Log Analytics workspace:  https://portal.loganalytics.io/demo#/ 

TIP: this can be a good place to check, if the solution is chargeable before you add it to your own!  or use this to guage the likely data quantity.  Also see https://blog.peterschen.de/data-volume-estimation-for-log-analytics/


 

//MBytes sent to Log Analytics by ALL solutions/Tables 
union withsource = tt *
//| where _IsBillable == true
| summarize MBytes=round(sum(_BilledSize/1024/1024),2)  by  Solution=tt  , _IsBillable
| sort by MBytes nulls last

image


You could then use this list to identify just one solution to drill into:

let SolutionName= "AzureDiagnostics";
union withsource = tt *
| where TimeGenerated > ago(1d)
| where _IsBillable == true
| where tt == SolutionName
| summarize MBytes=round(sum(_BilledSize/1024/1024),2) by Solution=tt , _IsBillable
| sort by MBytes nulls last


image


This last example, would build on the last query and look at just the NetworkSecurityGroup (NSG) resources.


union withsource = tt *
| where TimeGenerated > ago(1d)
| where _IsBillable == true
| where tt == "AzureDiagnostics" and ResourceType=="NETWORKSECURITYGROUPS"
| summarize MBytes=round(sum(_BilledSize/1024/1024),2) by Solution=tt , _IsBillable ,Resource
| sort by MBytes nulls last


image




Leave a Reply

Your email address will not be published. Required fields are marked *

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.