Help us shape the future of Go! Take the 2026 Go Developer Survey

azuremonitor

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 32 Imported by: 0

README

Azure Monitor Logs

Parity grade: B · SDK azure-sdk-for-go/sdk/monitor/ingestion/azlogs@v1.1.0 · last audited 2026-10-25 (6f3bb53ec)

Coverage

Metric Value
PARITY entries audited 20 (18 ok, 2 partial)
Feature families 6 (4 ok, 2 partial)
Known gaps 5
Deferred items 0
Resource leaks clean
Known gaps
  • KQL: join, lookup, mv-expand, parse, evaluate, search/find, make-series, user-defined functions, toscalar/materialize, cross-cluster calls, wildcard union, row_number/serialize and many rarer scalar functions answer 400 SemanticError. Dynamic values inside results are returned as JSON strings; dcount is exact, not HyperLogLog.
  • By default records that mismatch the stream schema are dropped silently and the upload answers 204, as Azure reports them only asynchronously in DCRLogErrors (Learn: data-collection-monitor); --azure-monitor-strict-ingest (AZURE_MONITOR_STRICT_INGEST) rejects such uploads with 400 InvalidPayload instead. Malformed JSON is always 400; the codes InvalidStream, InvalidPayload, InvalidContentEncoding, ContentLengthLimitExceeded and InvalidOutputTable are not verified against the live service. Azure's TimeGenerated age limits (14 days past, 2 days future) are not enforced.
  • Retention is stored and reported but never purges rows; there is no daily cap, billing or ingestion latency. Built-in tables are a small subset (Heartbeat, Syslog, Event, Perf, AzureActivity, AzureDiagnostics, Usage) with simplified columns and only accept data through DCRs that write to them.
  • Resource-centric queries (QueryResource on a non-workspace resource id) return empty tables; the emulator's own Azure service diagnostic logs are not routed into workspaces, and Azure Monitor diagnostic settings, data collection rule associations, saved searches, workspace purge, usages, schema, linked services and cluster resources are not implemented (Microsoft.OperationalInsights and Microsoft.Insights types without a dedicated handler stay in the generic metadata store).
  • Query statistics carry only executionTime; render/visualization output is not produced. Workspace delete is immediate (no 14-day soft delete, recover or force).

More

Documentation

Index

Constants

View Source 
const DefaultPort = 10013

DefaultPort is the Azure Monitor Logs HTTPS listener (query and ingestion APIs).

Variables

View Source 
var (
	ErrNilAppContext = errors.New("azuremonitor: nil app context")
	ErrNotFound      = errors.New("azuremonitor: resource not found")
	ErrConflict      = errors.New("azuremonitor: resource conflict")
	ErrInvalid       = errors.New("azuremonitor: invalid request")
	ErrUnsupported   = errors.New("azuremonitor: unsupported resource type")
)

Sentinel errors returned by the backend.

Functions

This section is empty.

Types

type Backend 

type Backend struct {
	// contains filtered or unexported fields
}

Backend holds workspaces, data collection endpoints and rules.

func NewBackend 

func NewBackend(settings Settings) *Backend

NewBackend creates an empty backend.

func (*Backend) Action 

func (b *Backend) Action(ref Ref, action string, _ map[string]any) (map[string]any, error)

Action runs a POST action on a workspace (sharedKeys, listKeys, regenerateSharedKey).

func (*Backend) Configure 

func (b *Backend) Configure(s Settings)

Configure replaces the settings after construction.

func (*Backend) Delete 

func (b *Backend) Delete(ref Ref) error

Delete removes a resource.

func (*Backend) DeleteInGroup 

func (b *Backend) DeleteInGroup(rg string)

DeleteInGroup removes every resource of the resource group.

func (*Backend) FindWorkspace 

func (b *Backend) FindWorkspace(idOrName string) (*Workspace, bool)

FindWorkspace resolves a customer ID, workspace name or ARM resource ID.

func (*Backend) Get 

func (b *Backend) Get(ref Ref) (map[string]any, error)

Get returns a resource's ARM body.

func (*Backend) Ingest 

func (b *Backend) Ingest(ruleID, stream string, records []map[string]any) *apiError

Ingest stores the records of one upload. Records are decoded JSON objects (numbers as json.Number).

func (*Backend) List 

func (b *Backend) List(ref Ref) ([]map[string]any, error)

List returns every resource of the ref's type under the subscription, resource group or parent.

func (*Backend) ListDataCollectionEndpoints 

func (b *Backend) ListDataCollectionEndpoints(host string) []map[string]any

ListDataCollectionEndpoints returns every data collection endpoint, advertising endpoints for host.

func (*Backend) ListDataCollectionRules 

func (b *Backend) ListDataCollectionRules(host string) []map[string]any

ListDataCollectionRules returns every data collection rule, advertising endpoints for host.

func (*Backend) ListWorkspaceTables 

func (b *Backend) ListWorkspaceTables(idOrName string) ([]map[string]any, error)

ListWorkspaceTables returns the ARM body of every table of the workspace named by id, customer id or name.

func (*Backend) ListWorkspaces 

func (b *Backend) ListWorkspaces() []map[string]any

ListWorkspaces returns the ARM body of every workspace across subscriptions.

func (*Backend) Patch 

func (b *Backend) Patch(ref Ref, body map[string]any) (map[string]any, error)

Patch updates tags (and, for workspaces and tables, selected properties).

func (*Backend) Put 

func (b *Backend) Put(ref Ref, body map[string]any) (map[string]any, error)

Put creates or replaces a resource and returns its ARM body.

func (*Backend) QueryJSON 

func (b *Backend) QueryJSON(idOrName string, req QueryRequest) (int, any)

QueryJSON runs a query against one workspace and returns the HTTP status and JSON-ready body the data-plane API would answer with (the error envelope on failure).

func (*Backend) QueryResource 

func (b *Backend) QueryResource(resourceID string, req QueryRequest, withStats bool) (*QueryResponse, *apiError)

QueryResource runs a resource-centric query.

func (*Backend) QueryWorkspace 

func (b *Backend) QueryWorkspace(idOrName string, req QueryRequest, withStats bool) (*QueryResponse, *apiError)

QueryWorkspace runs a query against one workspace.

func (*Backend) Reset 

func (b *Backend) Reset()

Reset clears all state.

func (*Backend) Restore 

func (b *Backend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot. It implements persistence.Persistable.

func (*Backend) SetClock 

func (b *Backend) SetClock(now func() time.Time)

SetClock replaces the time source.

func (*Backend) Snapshot 

func (b *Backend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state. It implements persistence.Persistable.

type Column 

type Column struct {
	Name        string `json:"name"`
	Type        string `json:"type"`
	Description string `json:"description,omitempty"`
	DisplayName string `json:"displayName,omitempty"`
}

Column is one table or stream column; Type is a KQL type name.

type ConfigProvider 

type ConfigProvider interface {
	GetAzureMonitorSettings() Settings
}

ConfigProvider extracts the Azure Monitor Logs settings from the AppContext config.

type DCE 

type DCE struct {
	Created     time.Time         `json:"created"`
	Tags        map[string]string `json:"tags"`
	Props       map[string]any    `json:"props"`
	Name        string            `json:"name"`
	Sub         string            `json:"sub"`
	RG          string            `json:"rg"`
	Location    string            `json:"location"`
	Kind        string            `json:"kind"`
	ImmutableID string            `json:"immutableId"`
}

DCE is a data collection endpoint.

type DCR 

type DCR struct {
	Created     time.Time         `json:"created"`
	Tags        map[string]string `json:"tags"`
	Props       map[string]any    `json:"props"`
	Identity    map[string]any    `json:"identity,omitempty"`
	Name        string            `json:"name"`
	Sub         string            `json:"sub"`
	RG          string            `json:"rg"`
	Location    string            `json:"location"`
	Kind        string            `json:"kind"`
	ImmutableID string            `json:"immutableId"`
}

DCR is a data collection rule.

type Handler 

type Handler struct {
	Backend *Backend
	// Issuer verifies bearer token signatures when Settings.ValidateTokens is set.
	Issuer *aadauth.Issuer

	// Settings holds the listener configuration.
	Settings Settings
	// Port is the fixed TCP port StartWorker binds.
	Port int
	// contains filtered or unexported fields
}

Handler serves the Logs Ingestion and Logs Query APIs on a dedicated HTTPS listener.

func NewHandler 

func NewHandler(backend *Backend, settings Settings) *Handler

NewHandler creates a Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation names the operation for metrics.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the request path for metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the data-plane operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler for the Azure Monitor Logs APIs.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Azure Monitor Logs runs on its own listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the listener.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the fixed port and serves HTTPS, failing fast if the port is taken.

type Provider 

type Provider struct{}

Provider implements service.Provider for Azure Monitor Logs.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init builds the backend and handler; the port is bound by Handler.StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type QueryRequest 

type QueryRequest struct {
	Query      string   `json:"query"`
	Timespan   string   `json:"timespan"`
	Workspaces []string `json:"workspaces"`
}

QueryRequest is the body of a query call.

type QueryResponse 

type QueryResponse struct {
	Statistics map[string]any `json:"statistics,omitempty"`
	Tables     []resultTable  `json:"tables"`
}

QueryResponse is the documented tables/columns/rows result.

type Ref 

type Ref struct {
	// Host is the request host (no port) used to build advertised endpoints.
	Host      string
	Sub       string
	RG        string
	Namespace string
	Types     []string
	Names     []string
}

Ref addresses an ARM resource served by this backend.

type Settings 

type Settings struct {
	TLSCertFile string `` //nolint:lll // config struct tags are intentionally verbose
	/* 248-byte string literal not displayed */
	TLSKeyFile string `` //nolint:lll // config struct tags are intentionally verbose
	/* 142-byte string literal not displayed */
	Advertise string `` //nolint:lll // config struct tags are intentionally verbose
	/* 233-byte string literal not displayed */
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 264-byte string literal not displayed */
	ValidateTokens bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 264-byte string literal not displayed */
	StrictIngest bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 264-byte string literal not displayed */
}

Settings is the Kong-embedded configuration of the Azure Monitor Logs emulator.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider exists.

type Table 

type Table struct {
	Created     time.Time `json:"created"`
	Name        string    `json:"name"`
	Plan        string    `json:"plan"`
	Description string    `json:"description,omitempty"`
	Columns     []Column  `json:"columns"`
	Rows        [][]any   `json:"-"`
	Retention   int       `json:"retention"`
	TotalRet    int       `json:"totalRetention"`
	Custom      bool      `json:"custom"`
}

Table is a workspace table with its rows. Cells use engine types (see kql.Rel).

type Workspace 

type Workspace struct {
	Created    time.Time         `json:"created"`
	Modified   time.Time         `json:"modified"`
	SKUUpdated time.Time         `json:"skuUpdated"`
	Tags       map[string]string `json:"tags"`
	Props      map[string]any    `json:"props"`
	Tables     map[string]*Table `json:"-"`
	Sub        string            `json:"sub"`
	RG         string            `json:"rg"`
	Location   string            `json:"location"`
	CustomerID string            `json:"customerId"`
	SKU        string            `json:"sku"`
	Primary    string            `json:"primaryKey"`
	Secondary  string            `json:"secondaryKey"`
	Name       string            `json:"name"`
	Retention  int               `json:"retention"`
}

Workspace is a Log Analytics workspace.

Source Files

View all Source files

Directories

Path Synopsis
Package kql implements a subset of the Kusto Query Language for the Azure Monitor Logs emulator.
 Package kql implements a subset of the Kusto Query Language for the Azure Monitor Logs emulator.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.