# Azure Monitor: Query Logs

Runs a KQL query against an Azure Monitor Log Analytics workspace to pull diagnostic log data for a specified time range.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Execute a KQL query against an Azure Monitor Log Analytics workspace to retrieve log data within a specified time range. This action enables automated log analysis during incident response, allowing teams to programmatically retrieve diagnostic data without manual searches in the Azure portal.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

| Name                               | Description                                                                                                      |
| :--------------------------------- | :--------------------------------------------------------------------------------------------------------------- |
| **Integration**                    | The Azure Monitor connection.                                                                                    |
| **Workspace ID**                   | The Log Analytics workspace ID (GUID).                                                                           |
| **Query**                          | KQL query. Example: `AzureActivity \| order by TimeGenerated desc \| take 10`.                                   |
| **Start Time**<br />_(Optional)_   | Start of the query time range. Pick a preset or type an ISO 8601 timestamp, for example, `2026-06-01T00:00:00Z`. |
| **End Time**<br />_(Optional)_     | End of the query time range. Pick a preset or type an ISO 8601 timestamp, for example, `2026-06-02T00:00:00Z`.   |
| **Result Limit**<br />_(Optional)_ | Maximum number of rows to return.                                                                                |

## Outputs

| Name               | Description                                                                         |
| :----------------- | :---------------------------------------------------------------------------------- |
| **Logs**           | JSON array of log rows matching the query.                                          |
| **Log Count**      | Number of log rows returned.                                                        |
| **Query Used**     | KQL query sent to the Log Analytics API.                                            |
| **Result**         | Value that shows if the action was successful or not. Either `Success` or `Failed`. |
| **Result Summary** | Brief description of what the action did or if it failed.                           |
| **Error**          | Brief description that is populated if the action failed.                           |

> **Query syntax:** The Query input must be a valid KQL expression, for example, `AzureActivity | order by TimeGenerated desc | take 10`.

<br />