One of my favorite tricks when building Azure Monitor or Azure Sentinel workbooks is to include the Azure Resource specific icons next to resources.
For metric based resources the icons are including for you automatically when using Grid visualization. But for logs, you need to bring in ‘_ResourceId’ in Log Analytics. For Azure Resourec Graph you need the ‘id’ field. In using both I have taken to not even bring in the name of the resource in my query. Workbooks are smart enough to parse down to just the resource name while simultaneously showing the Azure Resource Icon.
the other bonus of using the ID of the resource is, the workbooks automatically makes the resource clickable. So clicking it will take you to that resource overview.
Example with LogicApps from my LogicApp workbook.
And the original query, you can see the field is quite long in the log. Also of note, with LogicApps, you want to use workflowId_s instead of _ResourceId, as workflowId_s is the resource object in Azure, and the ResourceId field is used for the specific actions in your LogicApp.
So use id in Azure Resource Graph and _ResourceId in Log Analytics, except for LogicApps, to have Workbooks do magic on your resource names.
Hi, I’m Billy York. I’m a Consultant at Microsoft, former Cloud and Datacenter Management MVP, specializing in monitoring and automation. Here you’ll find posts about AzureMonitor, LogAnalytics, System Center Operations Manager, Powershell, Hyper-V, Azure Automation, Azure Governance and other Microsoft related technologies.