Log Analytics API

Question

Hi, I am trying to access my log analytics workspace through postman. I saw some documents and followed them but they weren't successful. My specific requirement is I have a FHIR service with audit logs enabled and streamed to Log analytics workspace. I want to access this logs using API. Can anyone explain the steps to do so including creating app, permissions, request to generate token, headers, body, request to query the workspace etc.

Thanks

Answer 1

Hi Subin Sabu
Here how to access your Log Analytics workspace and FHIR service audit logs through Postman:

Enable Diagnostic Settings for FHIR Service:

1.Go to your FHIR service in the Azure portal.

2.Under Monitoring, select Diagnostic settings.

3.Click + Add diagnostic setting.

4.Enter a name and choose a method to access logs.

5.Select AuditLogs and save.

6.Logs may take up to 15 minutes to appear in your Log Analytics workspace.

Create an Azure AD Application Registration:

1.Go to Azure Active Directory and click New Registration.

2.Name your application and register it.

3.Note the Application (client) ID.

4.Add the Log Analytics API permission with Data.Read access.

5.Grant admin consent and create a secret. Save the secret value.

Grant Access to Log Analytics Workspace:

1.Go to your Log Analytics workspace and click Access control (IAM).

2.Add a role assignment and select the Reader role.

3.Choose your application as a member and assign the role.

Access Log Analytics API using Postman:

1.Download Postman and create a new collection.

2.Create a POST request to get the access token from: https://login.microsoftonline.com/{your_Azure_Active_Directory_ID}/oauth2/token.

3.Use the following parameters in the body:

grant_type: client_credentials

client_id: Your Application (client) ID

resource: https://api.loganalytics.io

client_secret: Your secret value

4.Send the request and copy the access_token from the response.

Query the Log Analytics Workspace:

1.Create a POST request to: https://api.loganalytics.io/v1/workspaces/{your_log_analytics_workspace_ID}/query.

2.Use the Bearer Token for authorization and paste the access_token.

3.In the Body tab, use raw and JSON format with your query, such as:

Perf | where CounterName == 'Available MBytes' | summarize avg(CounterValue) by bin(TimeGenerated, 1h)

4.To get recent logs, use MicrosoftHealthcareApisAuditLogs | limit 100.

5.To group by FHIR resource type: MicrosoftHealthcareApisAuditLogs | summarize count() by FhirResourceType.

6.To get failed results: MicrosoftHealthcareApisAuditLogs | where ResultType == "Failed".

7.Send the request to view results.

Note: The application needs the Security Administrator role. It may take more than 15 minutes for logs to appear.

Refer: https://maykoninfo.blogspot.com/2020/10/log-analytics-api-access-using-postman.html
https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/fhir-service-diagnostic-logs

Please let us know if you required anything!