#AzureMonitor – How to use Resource Tags for filtering queries in Workbooks

One of the questions that we are often asked is how to use tags assigned to resources in Azure to create dashboards based on Kusto queries. Today, tags are not written into Log Analytics, so it is not possible to use tags for dynamic groupings in queries. However, with Azure Resource Graph and Workbooks, we can build a workaround Smile

In this example, we are using department as a resource tag. The following query can be executed in Azure Resource Graph to list all unique tags on all Azure resources.

| extend department = tostring(tags.Department)
| project department
| distinct department

This can be used as a parameter in a workbook. This is an example of how this parameter can be configured in a workbook. Note that the parameter type is set to drop down and that we use an Azure Resource Graph query to get departments.


If we want to display all the virtual machines that have the department tag equals what we choose from the department parameter drop-down, we can use the following query

| extend department = tags. Department
| where department == "{Department}" and type == "microsoft.compute/virtual machines"
| project name

We can then also use the query above as a query in a parameter, as the example below. In this example, we list all virtual machines that have the tag department set according to the department parameter.


We can now filter any queries in the workbook based on the selected criteria. The query below is a Kusto query that uses the result from the virtual machine parameter. The virtual machine parameter used an Azure Resource Graph query to get all virtual machines with the correct department tag.

Virtual machine names returned by Azure Resource Graph will be in the format of the virtual machine name only. In contrast, Log Analytics and Kusto will visualize the fully qualified domain name of the virtual machine. In the example below, we use the parse operator to return only the computer name without the domain.

| parse Computer with ComputerName "." *
| where ComputerName in ({VirtualMachines})
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| extend State = iff(LastHeartbeat < ago(15m), ‘Unhealthy’, ‘Healthy’)
| extend TimeFromNow = now() – LastHeartbeat
| extend ["TimeAgo"] = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ‘ seconds’), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ‘ minutes’), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ‘ hours’), strcat(toint(TimeFromNow / 1d), ‘ days’)), ‘ ago’)

Once we have it working in a workbook, we can pin the workbook to an Azure dashboard. The example below uses the queries and parameters explained in this blog post.

Workaround completed Smile


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s