Metadata - Get

Reference

Service:: Log Analytics

API Version:: 2022-10-27_Preview

Gets metadata information
Retrieve the metadata information for the workspace, including its schema, functions, workspace info, categories etc.

GET https://api.loganalytics.io/v1/workspaces/{workspaceId}/metadata

URI Parameters

Name	In	Required	Type	Description
workspaceId	path	True	string	ID of the workspace. This is Workspace ID from the Properties blade in the Azure portal.

Responses

Name	Type	Description
200 OK	metadataResults	OK. The API call succeeded and the metadata result is in the response payload
Other Status Codes	errorResponse	An error response object.

Security

oauth2

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

metadataGet

Sample request

HTTP

GET https://api.loganalytics.io/v1/workspaces/b438b4f6-912a-46d5-9cb1-b44069212abc/metadata

Sample response

Status code:: 200

{
  "tables": [
    {
      "id": "ADAssessmentRecommendation",
      "name": "ADAssessmentRecommendation",
      "description": "Recommendations generated by AD assessments that are started through a scheduled task. When you schedule the assessment it runs by default every 7 days and upload the data into Azure Log Analytics",
      "timespanColumn": "TimeGenerated",
      "columns": [
        {
          "name": "SourceSystem",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AssessmentId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Recommendation",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Description",
          "type": "string"
        },
        {
          "name": "RecommendationResult",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "TimeGenerated",
          "type": "datetime"
        },
        {
          "name": "FocusAreaId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "FocusArea",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ActionAreaId",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ActionArea",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationWeight",
          "type": "real"
        },
        {
          "name": "Computer",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AffectedObjectType",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "AffectedObjectName",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Forest",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Domain",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "DomainController",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Technology",
          "type": "string"
        },
        {
          "name": "CustomData",
          "type": "string"
        },
        {
          "name": "TargetCount",
          "type": "int"
        },
        {
          "name": "IsRollup",
          "type": "bool",
          "isPreferredFacet": true
        },
        {
          "name": "IsCopied",
          "type": "bool",
          "isPreferredFacet": true
        },
        {
          "name": "RecommendationPeriod",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "_ResourceId",
          "type": "string"
        }
      ],
      "related": {
        "categories": [
          "workloads"
        ],
        "solutions": [
          "ADAssessment"
        ],
        "resourceTypes": [
          "microsoft.compute/virtualmachines"
        ]
      }
    },
    {
      "id": "custom_CL",
      "name": "custom_CL",
      "timespanColumn": "TimeGenerated",
      "columns": [
        {
          "name": "SourceSystem",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "ManagementGroupName",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "TimeGenerated",
          "type": "datetime",
          "isPreferredFacet": true
        },
        {
          "name": "Computer",
          "type": "string",
          "isPreferredFacet": true
        },
        {
          "name": "RawData",
          "type": "string"
        },
        {
          "name": "Type",
          "type": "string"
        },
        {
          "name": "_ResourceId",
          "type": "string"
        }
      ],
      "related": {
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "solutions": [
    {
      "id": "ADAssessment",
      "name": "ADAssessment",
      "displayName": "Active Directory Health Check",
      "description": "Assess the risk and health of Active Directory environments.",
      "related": {
        "tables": [
          "ADAssessmentRecommendation"
        ],
        "functions": [
          "dwad"
        ],
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "functions": [
    {
      "id": "dwad",
      "name": "dwad",
      "displayName": "dasd",
      "body": "Heartbeat\r\n| where ResourceGroup != \"rg-SAP-DEVQA-005\" and ResourceGroup != \"rg-SAP-DEVQA-006\" and Computer contains \"\"\r\n| limit 500000\r\n| sort by Computer asc\r\n| distinct Computer\r\n",
      "related": {
        "solutions": [
          "ADAssessment"
        ],
        "workspaces": [
          "b438b4f6-912a-46d5-9cb1-b44069212abc"
        ]
      }
    }
  ],
  "resourceTypes": [
    {
      "id": "microsoft.compute/virtualmachines",
      "type": "Microsoft.Compute/VirtualMachines",
      "displayName": "Virtual machines",
      "related": {
        "tables": [
          "ADAssessmentRecommendation"
        ]
      }
    }
  ],
  "workspaces": [
    {
      "id": "b438b4f6-912a-46d5-9cb1-b44069212abc",
      "resourceId": "/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourceGroups/contosoazurehq/providers/microsoft.operationalinsights/workspaces/contosoretail-IT",
      "name": "contosoretail-IT",
      "region": "eastus",
      "related": {
        "resourceTypes": [
          "microsoft.compute/virtualmachines"
        ],
        "tables": [
          "custom_CL"
        ],
        "solutions": [
          "ADAssessment"
        ],
        "functions": [
          "dwad"
        ]
      }
    }
  ],
  "categories": [
    {
      "id": "workloads",
      "displayName": "Workloads",
      "related": {
        "tables": [
          "ADAssessmentRecommendation",
          "ADReplicationResult",
          "SQLAssessmentRecommendation",
          "WorkloadMonitoringPerf"
        ]
      }
    }
  ]
}

Definitions

Name	Description
Applications	The permission indication for the Application Insights apps on the metadata request.
Columns	The list of columns defined on the table
errorDetail	Error details.
errorInfo	The code and message for an error.
errorResponse	Error details.
metadataApplication	An Application Insights application.
metadataCategory	A metadata category.
MetadataColumnDataType	The data type of the column
metadataFunction	A stored function.
metadataPermissions	Permission information.
metadataQuery	A stored query.
metadataResourceType	A type of resource in Azure.
metadataResults	A metadata response.
metadataSolution	A Log Analytics solution.
metadataTable	A data table that takes part in a workspace schema.
metadataWorkspace	A Log Analytics workspace.
Related	The related metadata items for the category
Resources	The permission indication for the Azure resources on the metadata request.
Workspaces	The permission indication for the workspaces on the metadata request.

Applications

The permission indication for the Application Insights apps on the metadata request.

Name	Type	Description
resourceId	string	The resource ID on the permission indication.

Columns

The list of columns defined on the table

Name	Type	Description
description	string	The description of the column
isPreferredFacet	boolean	A flag indicating this column is a preferred facet
name	string	The name of the column
source	object	an indication of the source of the column, used only when multiple workspaces have conflicting definition for the column
type	MetadataColumnDataType	The data type of the column

errorDetail

Error details.

Name	Type	Description
additionalProperties	object	Additional properties that can be provided on the error details object
code	string	The error's code.
message	string	A human readable error message.
resources	string[]	Indicates resources which were responsible for the error.
target	string	Indicates which property in the request is responsible for the error.
value	string	Indicates which value in 'target' is responsible for the error.

errorInfo

The code and message for an error.

Name	Type	Description
additionalProperties	object	Additional properties that can be provided on the error info object
code	string	A machine readable error code.
details	errorDetail[]	error details.
innererror	errorInfo	The code and message for an error. Inner error details if they exist.
message	string	A human readable error message.

errorResponse

Error details.

Name	Type	Description
error	errorInfo	The code and message for an error. The error details.

metadataApplication

An Application Insights application.

Name	Type	Description
id	string	The ID of the Application Insights app.
name	string	The name of the Application Insights app.
region	string	The Azure region of the Application Insights app.
related	Related	The related metadata items for the Application Insights app.
resourceId	string	The ARM resource ID of the Application Insights app.

metadataCategory

A metadata category.

Name	Type	Description
description	string	The description of the category
displayName	string	The display name of the category
id	string	The ID of the category
related	Related	The related metadata items for the category

MetadataColumnDataType

The data type of the column

Name	Type	Description
bool	string
datetime	string
decimal	string
dynamic	string
guid	string
int	string
long	string
real	string
string	string
timespan	string

metadataFunction

A stored function.

Name	Type	Description
body	string	The KQL body of the function.
description	string	The description of the function.
displayName	string	The display name of the function.
id	string	The ID of the function.
name	string	The name of the function, to be used in queries.
parameters	string	The parameters/arguments of the function, if any.
properties	object	The properties of the function.
related	Related	The related metadata items for the function.
tags	object	The tags associated with the function.

metadataPermissions

Permission information.

Name	Type	Description
applications	Applications[]	The permission indication for the Application Insights apps on the metadata request.
resources	Resources[]	The permission indication for the Azure resources on the metadata request.
workspaces	Workspaces[]	The permission indication for the workspaces on the metadata request.

metadataQuery

A stored query.

Name	Type	Description
body	string	The KQL body of the query.
description	string	The description of the query.
displayName	string	The display name of the query.
id	string	The ID of the query.
labels	string[]	The user defined labels associated with the query.
properties	object	The properties of the query.
related	Related	The related metadata items for the query.
tags	object	The tags associated with the query.

metadataResourceType

A type of resource in Azure.

Name	Type	Description
description	string	The description of the resource-type
displayName	string	The display name of the resource-type
id	string	The ID of the resource-type
labels	string[]	The user-defined labels of the resource-type
properties	object	The properties of the resource-type
related	Related	The related metadata items for the resource-type
tags	object	The tags associated with the resource-type
type	string	The type of the resource-type

metadataResults

A metadata response.

Name	Type	Description
applications	metadataApplication[]	The list of Application Insights apps that were referenced in the metadata request.
categories	metadataCategory[]	The list of categories that are referenced in this metadata response.
functions	metadataFunction[]	The list of functions stored on the workspace, or introduced by solutions etc.
permissions	metadataPermissions[]	The list of permission rules that affected the metadata request.
queries	metadataQuery[]	The list of saved queries stored on the workspace, or introduced by solutions, resource types, etc.
resourceTypes	metadataResourceType[]	The list of resource types that are referenced in this metadata response.
resources	metadataResource[]	The list of Azure resources that were referenced in the metadata request.
solutions	metadataSolution[]	The list of Log Analytics solutions installed on the workspace.
tables	metadataTable[]	The list of tables and columns that comprise the schema of the workspace.
workspaces	metadataWorkspace[]	The list of Log Analytics workspaces that were referenced in the metadata request.

metadataSolution

A Log Analytics solution.

Name	Type	Description
description	string	The description of the Log Analytics solution
displayName	string	The display name of the Log Analytics solution
id	string	The ID of the Log Analytics solution
name	string	The name of the Log Analytics solution
properties	object	The properties of the Log Analytics solution
related	Related	The related metadata items for the Log Analytics solution
tags	object	The tags that are associated with the Log Analytics solution

metadataTable

A data table that takes part in a workspace schema.

Name	Type	Description
columns	Columns[]	The list of columns defined on the table
description	string	The description of the table
id	string	The ID of the table
labels	string[]	The user defined labels of the table
name	string	The name of the table
properties	object	The properties of the table
related	Related	The related metadata items for the table
tags	object	The tags associated with the table
timespanColumn	string	The column associated with the timespan query parameter for the table

metadataWorkspace

A Log Analytics workspace.

Name	Type	Description
id	string	The ID of the Log Analytics workspace.
name	string	The name of the Log Analytics workspace.
region	string	The Azure region of the Log Analytics workspace.
related	Related	The related metadata items for the Log Analytics workspace.
resourceId	string	The ARM resource ID of the Log Analytics workspace.

The related metadata items for the category

Name	Type	Description
functions	string[]	The functions related to the category
queries	string[]	The saved queries related to the category
resourceTypes	string[]	The resource types related to the category
solutions	string[]	The Log Analytics solutions related to the category
tables	string[]	The tables related to the category

Resources

The permission indication for the Azure resources on the metadata request.

Name	Type	Description
denyTables	string[]	The list of tables that were denied access for the resource ID.
resourceId	string	The resource ID on the permission indication.

Workspaces

The permission indication for the workspaces on the metadata request.

Name	Type	Description
denyTables	string[]	The list of tables that were denied access for the resource ID.
resourceId	string	The resource ID on the permission indication.

Share via

Metadata - Get

URI Parameters

Responses

Security

oauth2

Scopes

Examples

metadataGet

Sample request

Sample response

Definitions

Applications

Columns

errorDetail

errorInfo

errorResponse

metadataApplication

metadataCategory

MetadataColumnDataType

metadataFunction

metadataPermissions

metadataQuery

metadataResourceType

metadataResults

metadataSolution

metadataTable

metadataWorkspace

Resources

Workspaces

Additional resources

Share via

Metadata - Get

URI Parameters

Responses

Security

oauth2

Scopes

Examples

metadataGet

Sample request

Sample response

Definitions

Applications

Columns

errorDetail

errorInfo

errorResponse

metadataApplication

metadataCategory

MetadataColumnDataType

metadataFunction

metadataPermissions

metadataQuery

metadataResourceType

metadataResults

metadataSolution

metadataTable

metadataWorkspace

Related

Resources

Workspaces

Additional resources