Setup Azure Log Analytics Workspace for App Service

A Log Analytics workspace is a unique centralized spaces for log data from Azure Monitor and other Azure services, such as Azure App services, SQL databases where you can easily store, retain, and query data collected from various resources that have been monitored in Azure to provide valuable insights for those resources.

In this article, we’re going to explore how to Setup an Azure Logs Analytics Workspace which collects logs from an Azure App Service and some logs basic queries.

Prerequisites

• Azure CLI installed on your working machine. See How to install Azure CLI on Ubuntu 22.04
• Your Azure subscription and an Azure Credential has Contributor role on that subscription

Table of Contents

1. Create Azure resource group
2. Create and deploy simple-express App service
3. Create Azure Log Analytics Workspace
4. Configure your Azure App services Diagnostics Settings
5. Query data in Log Analytics Workspace

1. Create Azure resource group

Make sure you have the latest version of Azure CLI, follow below commands to start creating an Azure resource group. We’ll call it as simple-express:

# login into azure
az login --tenant <your Azure AD ID>
az account set --subscription <your Azure subscription>

RG="simple-express"
Location="northeurope"

# create Azure resource group called 'simple-express'
az group create --name $RG --location $Location
# Output
{
  "id": "/subscriptions/c3f3aa63-xxxx-xxf3ef/resourceGroups/simple-express",
  "location": "northeurope",
  "managedBy": null,
  "name": "simple-express",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

2. Create and Deploy an Azure Web App

We’re still using simple-express as your demo app service. Let’s create an Azure web app running with docker image hidetran/simple-express:latest in linux app service plan.

WebAppName="simple-express-webapp"
WebAppPlanName="simple-express-plan"
ImageTag="hidetran/simple-express:latest"

# create app service plan linux
az appservice plan create -n $WebAppPlanName -g $RG --is-linux

# create webapp with demo image
az webapp create -n $WebAppName --plan $WebAppPlanName -g $RG -i $ImageTag

# set webapp settings and restart app service
az webapp config appsettings set -g $RG -n $WebAppName --settings ENV_NAME=development
az webapp restart -n $WebAppName -g $RG

3. Create Azure Log Analytics Workspace

Azure Log Analytics Workspace will be created in the same resource group of the web app. We can deploy it to another resource/subscription as well. In this article, we’re going to use Pays-As-You-Go billing model which charged per gigabytes used.

# create azure Log Analytics Workspace
WorkSpaceName="simple-express-workspace"

az monitor log-analytics workspace create --resource-group $RG --workspace-name $WorkSpaceName --sku PerGB2018

4. Configure your Azure App services Diagnostics Settings

In daily monitoring operation, we often work with our App service console logs, our deployment platform logs and event HTTP request logs. Azure Logs Analytic Workspace provides some methods which help us in collecting data, querying data in some pattern and also method to trigger an alert s well.

Let’s have a look at the supported logs options on the web app service:

[
  {
    "category": "AppServiceHTTPLogs",
    "categoryGroup": null,
    "enabled": false,
    "retentionPolicy": {
      "days": 0,
      "enabled": false
    }
  },
  {
    "category": "AppServiceConsoleLogs",
    "categoryGroup": null,
    "enabled": false,
    "retentionPolicy": {
      "days": 0,
      "enabled": false
    }
  },
  {
    "category": "AppServiceAppLogs",
    "categoryGroup": null,
    "enabled": true,
    "retentionPolicy": {
      "days": 0,
      "enabled": false
    }
  },
  {
    "category": "AppServiceAuditLogs",
    "categoryGroup": null,
    "enabled": false,
    "retentionPolicy": {
      "days": 0,
      "enabled": false
    }
  },
  {
    "category": "AppServiceIPSecAuditLogs",
    "categoryGroup": null,
    "enabled": false,
    "retentionPolicy": {
      "days": 0,
      "enabled": false
    }
  },
  {
    "category": "AppServicePlatformLogs",
    "categoryGroup": null,
    "enabled": false,
    "retentionPolicy": {
      "days": 0,
      "enabled": false
    }
  }
]

To enable a log options, just change the enabled to true, you can also set its retention policy by setting its enabled value to true and select how many days it stays in the logs.

Let configure Azure Web App Diagnostics Setting to Log Analytics Workspace by using following log options:

• AppServiceHTTPLogs
• AppServiceConsoleLogs
• AppServiceAppLogs

# get WebApp resource id and Log Analytics Workspace resource id
WebAppResourceId=$(az webapp show --name $WebAppName --resource-group $RG --query id -o tsv | tr -d '\r')
WorkSpaceResourceId=$(az monitor log-analytics workspace show -n $WorkSpaceName -g $RG --query id -o tsv | tr -d '\r')

az monitor diagnostic-settings create --name $WebAppName -g $RG --resource $WebAppResourceId --workspace $WorkSpaceResourceId \
    --metrics '[
        {
          "category": "AllMetrics",
          "enabled": true,
          "retentionPolicy": {
            "days": 0,
            "enabled": false
          },
          "timeGrain": null
        }
      ]' \
    --logs '[
        {
          "category": "AppServiceHTTPLogs",
          "categoryGroup": null,
          "enabled": true,
          "retentionPolicy": {
            "days": 7,
            "enabled": true
          }
        },
        {
          "category": "AppServiceConsoleLogs",
          "categoryGroup": null,
          "enabled": true,
          "retentionPolicy": {
            "days": 7,
            "enabled": true
          }
        },
        {
          "category": "AppServiceAppLogs",
          "categoryGroup": null,
          "enabled": true,
          "retentionPolicy": {
            "days": 7,
            "enabled": true
          }
        }
      ]'

After configured, we can see Diagnostics Settings configured on Azure like

5. Query data in Log Analytics Workspace

Let’s open your Logs Analytics Workspace on Azure Portal > Select Logs in the left menu blade and type AppServiceConsoleLogs to the query editor, then select Time range and press Run. You can see your simple-express console logs was logged into the workspace:

Conclusion

Azure Logs Analytics Workspace can collect data/logs from another resources as well rather than Azure WebApp.

Source code for this article is now available at epiHATR/simple-express/scripts/webapp_with_log_workspace.sh