Speaking of which, let's take a look at Log Analytics and the Log Analytics
agent deployment process next. Azure Log Analytics is a cloud‑based log
aggregation platform. You can see on the left side of this diagram I drew
that we have logs emitted within Azure, certainly all of your Azure resources,
the Microsoft‑provided ones, emit log streams,
multi‑cloud, Google Cloud. I don't have AWS, but they're certainly
supported. In your on‑premises environment, those machines are kicking out
logs. You can actually create custom log sources.
That's why I have a gap here just to show you that.
So you may have line of business homegrown applications that generate logs
that you want to centrally manage, centrally report on.
That is the idea of Log Analytics.
You point those on and off cloud machines into your Log Analytics workspace.
The workspace is the Azure resource that houses all of the logs. And
Log Analytics, as long as it understands what the log is and what the
log definition is in terms of its schema,
it will convert those logs into what look like relational
database tables with columns and rows.
There is support, as I said, for custom logs as well.
So you're not limited only to the logs that Log
Analytics knows about out of box.
The Log Analytics workspace is a big data exploration and analytics engine.
If you're familiar at all with Hadoop and Apache Spark,
it's kind of like that. More to Apache Spark than Hadoop actually
because the idea is that in Log Analytics, you don't necessarily have
to submit your reporting queries and then sit there and wait or come
back the next day to check on it.
You can run the queries and see the results within seconds.
It's a massively scalable cluster that's running under the hood.
Lastly, how do we query our Log Analytics workspace?
Well,
we use a unified query language Microsoft developed called Kusto,
K‑u‑s‑t‑o. And that's a play on Jacques Cousteau,
the late great oceanographer and explorer, because the idea here is that KQL
allows us to explore the vast log data that we've aggregated in our hybrid
cloud environment. And you can see that the syntax is familiar to you if you've
used the Splunk language or AWS log search.
There are some elements of Structured Query Language, or SQL. There's
some elements of PowerShell and Bash in here as well.
It's a pretty cool language, and it's very powerful, indeed. We'll see more about it in the upcoming demo.