swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: Azure Log Analytics API reference for management of saved Queries within Query Packs.
  title: Azure Log Analytics Query Packs
  version: 2019-09-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2019-09-01-preview/QueryPackQueries_API.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: applicationinsights-QueryPackQueries_API
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow.
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ContinuationTokenParameter:
    description: Base64 encoded token used to fetch the next page of items. Default is null.
    in: query
    name: $skipToken
    required: false
    type: string
    x-ms-parameter-location: method
  IncludeBodyParameter:
    description: Flag indicating whether or not to return the body of each applicable query. If false, only return the query information.
    in: query
    name: includeBody
    required: false
    type: boolean
    x-ms-parameter-location: method
  MaxItemCountParameter:
    description: Maximum items returned in page.
    in: query
    name: $top
    required: false
    type: integer
    x-ms-parameter-location: method
  QueryIdParameter:
    description: The id of a specific query defined in the Log Analytics QueryPack
    in: path
    name: queryId
    required: true
    type: string
    x-ms-parameter-location: method
  QueryPackNameParameter:
    description: The name of the Log Analytics QueryPack resource.
    in: path
    name: queryPackName
    required: true
    type: string
    x-ms-parameter-location: method
paths:
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries":
    get:
      description: Gets a list of Queries defined within a Log Analytics QueryPack.
      operationId: Queries_List
      parameters:
        - description: The ID of the target subscription.
          in: path
          minLength: 1
          name: subscriptionId
          required: true
          type: string
        - description: The name of the resource group. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/QueryPackNameParameter"
        - description: The API version to use for this operation.
          in: query
          minLength: 1
          name: api-version
          required: true
          type: string
        - $ref: "#/parameters/MaxItemCountParameter"
        - $ref: "#/parameters/IncludeBodyParameter"
        - $ref: "#/parameters/ContinuationTokenParameter"
      responses:
        "200":
          description: A list containing 0 or more queries contained within the Log Analytics QueryPack.
          schema:
            $ref: "#/definitions/LogAnalyticsQueryPackQueryListResult"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      x-ms-examples:
        QueryList:
          parameters:
            api-version: 2019-09-01-preview
            includeBody: true
            queryPackName: my-querypack
            resourceGroupName: my-resource-group
            subscriptionId: 86dc51d3-92ed-4d7e-947a-775ea79b4918
          responses:
            "200":
              body:
                nextLink: null
                value:
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/4337bb16-d6fe-4ff7-97cf-59df25941476
                    name: 4337bb16-d6fe-4ff7-97cf-59df25941476
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: heartbeat | take 10
                      description: Thie query takes 10 entries of heartbeat
                      displayName: Heartbeat_1
                      queryId: 4337bb16-d6fe-4ff7-97cf-59df25941476
                      timeCreated: 2019-08-15T10:29:56.1030254Z
                      timeModified: 2019-08-15T10:29:56.1030254Z
                    type: microsoft.insights/queryPacks/queries
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/bf015bf7-be70-49c2-8d52-4cce85c42ef1
                    name: bf015bf7-be70-49c2-8d52-4cce85c42ef1
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: heartbeat | take 10
                      description: Thie query takes 10 entries of heartbeat
                      displayName: Heartbeat_2
                      queryId: bf015bf7-be70-49c2-8d52-4cce85c42ef1
                      timeCreated: 2019-08-15T10:30:26.7943629Z
                      timeModified: 2019-08-15T10:30:26.7943629Z
                    type: microsoft.insights/queryPacks/queries
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/8d91c6ca-9c56-49c6-b3ae-112a68871acd
                    name: 8d91c6ca-9c56-49c6-b3ae-112a68871acd
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: heartbeat | take 10
                      description: Thie query takes 10 entries of heartbeat
                      displayName: Heartbeat_3
                      queryId: 8d91c6ca-9c56-49c6-b3ae-112a68871acd
                      timeCreated: 2019-08-15T10:30:29.4505584Z
                      timeModified: 2019-08-15T10:30:29.4505584Z
                    type: microsoft.insights/queryPacks/queries
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/a5a9010e-e4b7-45ad-8b14-09d7e6082819
                    name: a5a9010e-e4b7-45ad-8b14-09d7e6082819
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: heartbeat | take 10
                      description: Thie query takes 10 entries of heartbeat
                      displayName: Heartbeat_4
                      queryId: a5a9010e-e4b7-45ad-8b14-09d7e6082819
                      timeCreated: 2019-08-15T10:30:32.5742324Z
                      timeModified: 2019-08-15T10:30:32.5742324Z
                    type: microsoft.insights/queryPacks/queries
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/search":
    post:
      description: Search a list of Queries defined within a Log Analytics QueryPack according to given search properties.
      operationId: Queries_Search
      parameters:
        - description: The ID of the target subscription.
          in: path
          minLength: 1
          name: subscriptionId
          required: true
          type: string
        - description: The name of the resource group. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/QueryPackNameParameter"
        - description: The API version to use for this operation.
          in: query
          minLength: 1
          name: api-version
          required: true
          type: string
        - $ref: "#/parameters/MaxItemCountParameter"
        - $ref: "#/parameters/IncludeBodyParameter"
        - $ref: "#/parameters/ContinuationTokenParameter"
        - description: Properties by which to search queries in the given Log Analytics QueryPack.
          in: body
          name: QuerySearchProperties
          required: true
          schema:
            $ref: "#/definitions/LogAnalyticsQueryPackQuerySearchProperties"
      responses:
        "200":
          description: A list containing 0 or more queries contained within the Log Analytics QueryPack.
          schema:
            $ref: "#/definitions/LogAnalyticsQueryPackQueryListResult"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      x-ms-examples:
        QuerySearch:
          parameters:
            $top: 3
            QuerySearchProperties:
              categories:
                - other
                - analytics
              labels:
                - my-label
            api-version: 2019-09-01-preview
            includeBody: true
            queryPackName: my-querypack
            resourceGroupName: my-resource-group
            subscriptionId: 86dc51d3-92ed-4d7e-947a-775ea79b4918
          responses:
            "200":
              body:
                nextLink: null
                value:
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/4337bb16-d6fe-4ff7-97cf-59df25941476
                    name: 4337bb16-d6fe-4ff7-97cf-59df25941476
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: Heartbeat | take 1
                      categories:
                        - other
                      description: Thie query takes 10 entries of heartbeat 0
                      displayName: Heartbeat_1
                      labels:
                        - my-label
                      queryId: 4337bb16-d6fe-4ff7-97cf-59df25941476
                      timeCreated: 2019-08-15T10:29:56.1030254Z
                      timeModified: 2019-08-15T10:29:56.1030254Z
                    type: microsoft.insights/queryPacks/queries
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/bf015bf7-be70-49c2-8d52-4cce85c42ef1
                    name: bf015bf7-be70-49c2-8d52-4cce85c42ef1
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: Heartbeat | take 1
                      categories:
                        - analytics
                      description: Thie query takes 10 entries of heartbeat 1
                      displayName: Heartbeat_2
                      labels:
                        - my-label
                      queryId: bf015bf7-be70-49c2-8d52-4cce85c42ef1
                      timeCreated: 2019-08-15T10:30:26.7943629Z
                      timeModified: 2019-08-15T10:30:26.7943629Z
                    type: microsoft.insights/queryPacks/queries
                  - id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/8d91c6ca-9c56-49c6-b3ae-112a68871acd
                    name: 8d91c6ca-9c56-49c6-b3ae-112a68871acd
                    properties:
                      author: 1809f206-263a-46f7-942d-4572c156b7e7
                      body: Heartbeat | take 1
                      categories:
                        - other
                        - analytics
                      description: Thie query takes 10 entries of heartbeat 2
                      displayName: Heartbeat_3
                      labels:
                        - my-label
                      queryId: 8d91c6ca-9c56-49c6-b3ae-112a68871acd
                      timeCreated: 2019-08-15T10:30:29.4505584Z
                      timeModified: 2019-08-15T10:30:29.4505584Z
                    type: microsoft.insights/queryPacks/queries
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}":
    delete:
      description: Deletes a specific Query defined within an Log Analytics QueryPack.
      operationId: Queries_Delete
      parameters:
        - description: The ID of the target subscription.
          in: path
          minLength: 1
          name: subscriptionId
          required: true
          type: string
        - description: The name of the resource group. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/QueryPackNameParameter"
        - $ref: "#/parameters/QueryIdParameter"
        - description: The API version to use for this operation.
          in: query
          minLength: 1
          name: api-version
          required: true
          type: string
      responses:
        "200":
          description: The query has been successfully removed from the Log Analytics QueryPack
        "204":
          description: The specified query or associated QueryPack does not exist.
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      x-ms-examples:
        QueryDelete:
          parameters:
            api-version: 2019-09-01-preview
            queryId: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
            queryPackName: my-querypack
            resourceGroupName: my-resource-group
            subscriptionId: 86dc51d3-92ed-4d7e-947a-775ea79b4918
          responses:
            "200": {}
            "204": {}
    get:
      description: Gets a specific Log Analytics Query defined within a Log Analytics QueryPack.
      operationId: Queries_Get
      parameters:
        - description: The ID of the target subscription.
          in: path
          minLength: 1
          name: subscriptionId
          required: true
          type: string
        - description: The name of the resource group. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/QueryPackNameParameter"
        - $ref: "#/parameters/QueryIdParameter"
        - description: The API version to use for this operation.
          in: query
          minLength: 1
          name: api-version
          required: true
          type: string
      responses:
        "200":
          description: A single query contained within the Log Analytics QueryPack.
          schema:
            $ref: "#/definitions/LogAnalyticsQueryPackQuery"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      x-ms-examples:
        QueryGet:
          parameters:
            api-version: 2019-09-01-preview
            queryId: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
            queryPackName: my-querypack
            resourceGroupName: my-resource-group
            subscriptionId: 86dc51d3-92ed-4d7e-947a-775ea79b4918
          responses:
            "200":
              body:
                id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/a449f8af-8e64-4b3a-9b16-5a7165ff98c4
                name: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
                properties:
                  body: |
                    let newExceptionsTimeRange = 1d;
                    let timeRangeToCheckBefore = 7d;
                    exceptions
                    | where timestamp < ago(timeRangeToCheckBefore)
                    | summarize count() by problemId
                    | join kind= rightanti (
                    exceptions
                    | where timestamp >= ago(newExceptionsTimeRange)
                    | extend stack = tostring(details[0].rawStack)
                    | summarize count(), dcount(user_AuthenticatedId), min(timestamp), max(timestamp), any(stack) by problemId  
                    ) on problemId 
                    | order by  count_ desc
                  description: Thie query fetcges the recent exceptions from the last 24 hours
                  displayName: Exceptions - New in the last 24 hours
                  queryId: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
                  timeCreated: 2018-02-12T11:44:39.2980634Z
                  timeModified: 2018-02-14T13:13:19.3381394Z
                type: microsoft.insights/queryPacks/queries
    put:
      description: Adds or Updates a specific Query within a Log Analytics QueryPack.
      operationId: Queries_Put
      parameters:
        - description: The ID of the target subscription.
          in: path
          minLength: 1
          name: subscriptionId
          required: true
          type: string
        - description: The name of the resource group. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/QueryPackNameParameter"
        - $ref: "#/parameters/QueryIdParameter"
        - description: The API version to use for this operation.
          in: query
          minLength: 1
          name: api-version
          required: true
          type: string
        - description: Properties that need to be specified to create a new query and add it to a Log Analytics QueryPack.
          in: body
          name: QueryPayload
          required: true
          schema:
            $ref: "#/definitions/LogAnalyticsQueryPackQuery"
      responses:
        "200":
          description: The new or updated query contained within the Log Analytics QueryPack.
          schema:
            $ref: "#/definitions/LogAnalyticsQueryPackQuery"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      x-ms-examples:
        QueryPut:
          parameters:
            QueryPayload:
              properties:
                body: |
                  let newExceptionsTimeRange = 1d;
                  let timeRangeToCheckBefore = 7d;
                  exceptions
                  | where timestamp < ago(timeRangeToCheckBefore)
                  | summarize count() by problemId
                  | join kind= rightanti (
                  exceptions
                  | where timestamp >= ago(newExceptionsTimeRange)
                  | extend stack = tostring(details[0].rawStack)
                  | summarize count(), dcount(user_AuthenticatedId), min(timestamp), max(timestamp), any(stack) by problemId  
                  ) on problemId 
                  | order by  count_ desc
                categories:
                  - analytics
                description: my description
                displayName: Exceptions - New in the last 24 hours
                labels:
                  - my-label
                  - my-other-label
                linkedResourceId: /subscriptions/a51967b5-271e-4f12-810e-e7fa20c8828d/resourceGroups/FoodHere/providers/Microsoft.KeyVault/vaults/FoodHere
            api-version: 2019-09-01-preview
            queryId: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
            queryPackName: my-querypack
            resourceGroupName: my-resource-group
            subscriptionId: 86dc51d3-92ed-4d7e-947a-775ea79b4918
          responses:
            "200":
              body:
                id: /subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4918/resourceGroups/my-resource-group/providers/microsoft.insights/queryPacks/my-querypack/queries/a449f8af-8e64-4b3a-9b16-5a7165ff98c4
                name: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
                properties:
                  author: 1809f206-263a-46f7-942d-4572c156b7e7
                  body: |
                    let newExceptionsTimeRange = 1d;
                    let timeRangeToCheckBefore = 7d;
                    exceptions
                    | where timestamp < ago(timeRangeToCheckBefore)
                    | summarize count() by problemId
                    | join kind= rightanti (
                    exceptions
                    | where timestamp >= ago(newExceptionsTimeRange)
                    | extend stack = tostring(details[0].rawStack)
                    | summarize count(), dcount(user_AuthenticatedId), min(timestamp), max(timestamp), any(stack) by problemId  
                    ) on problemId 
                    | order by  count_ desc
                  categories:
                    - analytics
                  description: my description
                  displayName: Exceptions - New in the last 24 hours
                  labels:
                    - my-label
                    - my-other-label
                  linkedResourceId: /subscriptions/a51967b5-271e-4f12-810e-e7fa20c8828d/resourceGroups/FoodHere/providers/Microsoft.KeyVault/vaults/FoodHere
                  queryId: a449f8af-8e64-4b3a-9b16-5a7165ff98c4
                  timeCreated: 2019-08-15T10:30:32.5742324Z
                  timeModified: 2019-08-15T10:30:32.5742324Z
                type: microsoft.insights/queryPacks/queries
definitions:
  AzureResourceProperties:
    description: An Azure resource QueryPack-Query object
    properties:
      id:
        description: Azure resource Id
        readOnly: true
        type: string
      name:
        description: Azure resource name
        readOnly: true
        type: string
      type:
        description: Azure resource type
        readOnly: true
        type: string
  ErrorResponse:
    description: Describe the format of an Error response.
    properties:
      code:
        description: Error code
        type: string
      message:
        description: Error message indicating why the operation failed.
        type: string
    type: object
  LogAnalyticsQueryPackQuery:
    allOf:
      - $ref: "#/definitions/AzureResourceProperties"
    description: A Log Analytics QueryPack-Query definition.
    properties:
      properties:
        $ref: "#/definitions/LogAnalyticsQueryPackQueryProperties"
        description: Properties that define an Log Analytics QueryPack-Query resource.
        x-ms-client-flatten: true
  LogAnalyticsQueryPackQueryListResult:
    description: Describes the list of Log Analytics QueryPack-Query resources.
    properties:
      nextLink:
        description: The URI to get the next set of Log Analytics QueryPack definitions if too many QueryPack-Queries where returned in the result set.
        type: string
      value:
        description: List of Log Analytics QueryPack Query definitions.
        items:
          $ref: "#/definitions/LogAnalyticsQueryPackQuery"
        type: array
    required:
      - value
  LogAnalyticsQueryPackQueryProperties:
    description: Properties that define an Log Analytics QueryPack-Query resource.
    properties:
      author:
        description: Object Id of user creating the query.
        readOnly: true
        type: string
      body:
        description: Body of the query.
        readOnly: false
        type: string
      categories:
        description: Categories associated with the query.
        items:
          type: string
        type: array
      description:
        description: Description of the query.
        readOnly: false
        type: string
      displayName:
        description: Unique display name for your query within the Query Pack.
        readOnly: false
        type: string
      labels:
        description: Labels associated with the query.
        items:
          type: string
        type: array
      linkedResourceId:
        description: Resource id associated with the query.
        readOnly: false
        type: string
      queryId:
        description: The unique ID of your application. This field cannot be changed.
        readOnly: true
        type: string
      resourceTypes:
        description: Resource Types associated with the query.
        items:
          type: string
        type: array
      timeCreated:
        description: Creation Date for the Log Analytics Query, in ISO 8601 format.
        format: date-time
        readOnly: true
        type: string
      timeModified:
        description: Last modified date of the Log Analytics Query, in ISO 8601 format.
        format: date-time
        readOnly: true
        type: string
    required:
      - body
      - displayName
  LogAnalyticsQueryPackQuerySearchProperties:
    description: Properties that define an Log Analytics QueryPack-Query search properties.
    properties:
      categories:
        description: Categories associated with the query.
        items:
          type: string
        type: array
      labels:
        description: Labels associated with the query.
        items:
          type: string
        type: array
      resourceTypes:
        description: Resource Types associated with the query.
        items:
          type: string
        type: array
