api_log_analytics_client: Azure Log Analytics API Class

In azr: Credential Chain for OAuth 2.0 Authentication to 'Azure'

Azure Log Analytics API Class

Description

An R6 class that extends api_client to provide a Kusto Query Language (KQL) query() method against the public Azure Log Analytics REST API, bound to a specific Azure subscription and resource group at construction.

Details

The client is bound to subscription_id and resource_id (the resource group name) at construction. The ⁠$query()⁠ method issues a POST to ⁠https://{endpoint}/{api_version}/subscriptions/{subscription_id}/resourceGroups/{resource_id}/query⁠ with a JSON body (⁠{"query": ..., "timespan": ..., "workspaces": [...]}⁠).

Pass scope = "hierarchy" (or any other supported query-string parameter) via ... on ⁠$query()⁠ to traverse the resource hierarchy.

Super class

api_client -> api_log_analytics_client

Public fields

.subscription_id

The Azure subscription ID the client is bound to.

.resource_id

The Azure resource group name the client is bound to.

.api_version

The API version segment prepended to all query paths.

Methods

Public methods

• api_log_analytics_client$new()

• api_log_analytics_client$query()

• api_log_analytics_client$clone()

Inherited methods

• api_client$.build_request()
• api_client$.fetch()
• api_client$.get_token()
• api_client$.resp_body_content()
• api_client$.resp_content()
• api_client$.send_request()

---

api_log_analytics_client$new()

Create a new Azure Log Analytics API client instance bound to a specific subscription and resource group.

Usage

api_log_analytics_client$new(
  subscription_id,
  resource_id,
  endpoint = default_log_analytics_endpoint(),
  api_version = "v1",
  scope = default_azure_scope("azure_log_analytics"),
  provider = NULL,
  chain = NULL,
  tenant_id = NULL,
  ...
)

Arguments

subscription_id

A character string specifying the Azure subscription ID (GUID) to bind the client to.

resource_id

A character string specifying the Azure resource group name to bind the client to.

endpoint

A character string specifying the Log Analytics query endpoint host (e.g. "api.loganalytics.io"). Defaults to default_log_analytics_endpoint(). Any leading ⁠https?://⁠ scheme or trailing slashes are stripped.

api_version

A character string specifying the API version segment prepended to the query path. Defaults to "v1".

scope

A character string specifying the OAuth2 scope. Defaults to default_azure_scope("azure_log_analytics").

provider

An optional credential provider object that inherits from Credential or DefaultCredential. If provided, chain is ignored.

chain

A credential_chain instance for authentication. If NULL, a default credential chain is created using DefaultCredential.

tenant_id

A character string specifying the Azure tenant ID. Passed to DefaultCredential when chain is NULL.

...

Additional arguments passed to the parent api_client constructor.

Returns

A new api_log_analytics_client object

---

api_log_analytics_client$query()

Issue a KQL query against the bound subscription and resource group.

Usage

api_log_analytics_client$query(
  query,
  date_from = Sys.Date() - 3,
  date_to = Sys.Date() + 1,
  timespan = NULL,
  max_rows = 500001L,
  options = list(truncationMaxSize = 67108864L),
  workspace_filters = list(regions = list()),
  ...,
  raw = FALSE,
  coerce_types = TRUE
)

Arguments

query

A character string containing the KQL query to execute.

date_from

Start of the time range as a Date or POSIXct. When provided together with date_to, appends ⁠| where TimeGenerated between(datetime(...), datetime(...))⁠ to the query and sets timespan to NULL. Defaults to Sys.Date() - 3.

date_to

End of the time range as a Date or POSIXct. Defaults to Sys.Date() + 1.

timespan

An ISO 8601 duration (e.g. "PT12H") or start/end pair separated by / (e.g. "2024-01-01/2024-01-02"). Passed as a URL query parameter. Ignored when date_from and date_to are set. Defaults to NULL.

max_rows

Maximum number of rows to return. Defaults to 500001.

options

A named list of query options. Defaults to list(truncationMaxSize = 67108864).

workspace_filters

A named list of workspace filters. Defaults to list(regions = list()).

...

Additional URL query parameters. Override defaults (e.g. scope = "resource" to change from the default "hierarchy").

raw

If TRUE, returns the parsed JSON response as a list. If FALSE (the default), returns a named list of data.frames — one per table in the response — or the single table directly if only one is returned.

coerce_types

If TRUE (the default), columns are coerced to their native R types based on the Log Analytics schema (e.g. datetime → POSIXct, bool → logical). Set to FALSE to keep all values as character.

Returns

Either a single data.frame, a named list of data.frames, or the raw parsed response (when raw = TRUE).

---

api_log_analytics_client$clone()

The objects of this class are cloneable with this method.

Usage

api_log_analytics_client$clone(deep = FALSE)

Arguments

deep

Whether to make a deep clone.

Examples

## Not run: 
la <- api_log_analytics_client$new(
  subscription_id = "00000000-0000-0000-0000-000000000000",
  resource_id = "my-resource-group"
)

la$query(
  query = "AzureDiagnostics | take 10",
  timespan = "PT12H",
  scope = "hierarchy"
)

## End(Not run)

azr documentation built on Nov. 13, 2026, 5:07 p.m.