Azure / Azure/azure-cli

az monitor log-analytics query incorrectly process multiline analytics-query parameter

Open
#29,152 1 comment 0 reactions 1 assignee Claimed by @AllyW View on GitHub
act-observability-squad Auto-Assign Azure CLI Team customer-reported Monitor potential-pruning question
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

A mutli-line analytics query is stripped, only first line is taken into consideration, the rest of the query is ignored.

### Related command

```
$la=$(az monitor log-analytics workspace list) | ConvertFrom-Json
$sentinelLA = $la | ?{$_.Name -eq $SENTINEL_LA_NAME}

query = @"
SigninLogs
| where TimeGenerated > ago(30minutes)
| distinct UserPrincipalName,tostring(DeviceDetail.displayName)
| limit 10
"@

$signInLogs=$(az monitor log-analytics query -w $sentinelLA.customerId --analytics-query $query)
```

### Errors

`az monitor log-analytics query` returns all the date from SignInLogs

### Issue script & Debug output

`az monitor log-analytics query` returns all the date from SignInLogs

### Expected behavior

the filter ```where TimeGenerated > ago(30minutes)``` should be taken into consideration, also the limit etc.

### Environment Summary

```
azure-cli 2.61.0

core 2.61.0
telemetry 1.1.0

Extensions:
log-analytics 0.2.2

Dependencies:
msal 1.28.0
azure-mgmt-resource 23.1.1

Python location 'C:\temp\azure-cli-2.61.0-x64\python.exe'
Extensions directory 'C:\Users\martinr\.azure\cliextensions'

Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 22:03:32) [MSC v.1937 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.
```

### Additional context

[https://martin.rublik.eu/2024/06/11/az-cli-and-loganalytics.html](https://martin.rublik.eu/2024/06/11/az-cli-and-loganalytics.html) you can find detailed information here, along with workaround for this issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.