Azure Log Analytics - 搜索 REST API - 如何对结果进行分页

Question

When grabbing search result using Azure Log Analytics Search REST API I'm able to receive only the first 5000 results (as by the specs, at the top of the document), but know there are many more (by the "total" attribute in the metadata in the response).

Is there a way to paginate so to get the entire result set?

One hacky way would be to attempt to break down the desired time-range iteratively until the "total" is less than 5000 for that timeframe, and do this process iteratively for the entire desired time-range - but this is guesswork that will cost many redundant requests.

Answer 1

While it doesn't appear to be a way to paginate using the REST API itself, you can use your query to perform the pagination. The two key operators here are TOP and SKIP:

Suppose you want page n with pagesize x (starting at page 1), then append to your query: query | skip (n-1) * x | top x query | skip (n-1) * x | top x query | skip (n-1) * x | top x .

For a full reference list, see https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-search-reference

Answer 2

Yes, skip operation is not available anymore but if you want create pagination there is still an option. You need to count total count of entries, use a simple math and two opposite sortings.

Prerequisites for this query are values: ContainerName, Namespace, Page, PageSize. I'm using it in Workbook where these values are set by fields.

let containers = KubePodInventory 
| where ContainerName matches regex '^.*{ContainerName}$' and Namespace == '{Namespace}'
| distinct ContainerID
| project ContainerID;
let TotalCount = toscalar(ContainerLog 
| where ContainerID in (containers)
| where LogEntry contains '{SearchText}'
| summarize CountOfLogs = count()
| project CountOfLogs);
ContainerLog 
| where ContainerID in (containers)
| where LogEntry contains '{SearchText}'
| extend Log=replace(@'(\x1b\[[0-9]*m|\x1b\[0 [0-9]*m)','', LogEntry)
| project TimeGenerated, Log
| sort by TimeGenerated asc
| take {PageSize}*{Page}
| top iff({PageSize}*{Page} > TotalCount, TotalCount - ({PageSize}*({Page} - 1)) , {PageSize}) by TimeGenerated desc;

// The '| extend' is not needed if in logs are not the annoying special characters