Using Kqlmagic to connect to Log Analytics in Azure Data Studio notebook

This blog post is a quick follow up on an important tip that I shared in my recent presentation on Kusto Query Language (KQL) with Azure Data Studio session at SQL Saturday #1019 Singapore on Nov 28, 2020 – see the slide deck and session notes. Specifically, this tip is for those who want to analyze Log Analytics dataset in a notebook using Kqlmagic.

Tip: Download Azure Data Studio – http://aka.ms/getAzureDataStudio.

To do this, you’ll need to ensure that you have Kqlmagic installed. See Install and set up Kqlmagic in a notebook. Then in a notebook, you can load Kqlmagic with %reload_ext Kqlmagic in a code cell.

The next step is then in a new code cell, you can start connecting to a Log Analytics workspace. There are three ways to do so (roughly – as I’m also learning in this space too):

1. Using Azure Active Directory Device Login authentication.
2. Using Az CLI login
3. Using Client Secret

In this blog post, I’m going to go through a popular way of connecting to a Log Analytics workspace with Kqlmagic, – i.e. using Azure Active Directory Login authentication.

%kql loganalytics://code;workspace='<WorkspaceID>'

If you are working with multiple tenants and/or multiple Azure Accounts with different tenants, it would be best to also provide the Tenant ID in the connection like this:

%kql loganalytics://tenant=<TenantID>;workspace='<WorkspaceID>'

How to get Log Analytics Workspace ID

You can go to Azure Portal (https://portal.azure.com) and navigate to your Log Analytics workspace. From here, you can find Workspace ID, which is a GUID.

How to get the Tenant ID of your Log Analytics workspace

From Azure Portal, search for Azure Active Directory. From there you can find your Tenant ID value.

Putting it all together

Below is an example of a notebook in Azure Data Studio, using Kqlmagic to connect to a Log Analytics workspace using Workspace ID.

Further Reading

For more tips and tricks on using KQL in Azure Data Studio, please see my KQL in Azure Data Studio slide deck and session notes.