|
| 1 | +--- |
| 2 | +title: Configure logging |
| 3 | +titleSuffix: Azure AI Search |
| 4 | +description: Set up diagnostic logging to collect information about indexing and query processing in Azure AI Search resource logs. |
| 5 | + |
| 6 | +manager: nitinme |
| 7 | +author: HeidiSteen |
| 8 | +ms.author: heidist |
| 9 | +ms.service: azure-ai-search |
| 10 | +ms.topic: how-to |
| 11 | +ms.date: 01/28/2025 |
| 12 | +--- |
| 13 | + |
| 14 | +# Configure diagnostic logging for Azure AI Search |
| 15 | + |
| 16 | +Resource-level diagnostic logs provide insight into operations that occur in your Azure AI Search resource. In contrast, activity logs provide an insight into the operations performed on each Azure resource in the subscription from the outside, known as the control plane or management plane. Activity logging is enabled automatically, and often |
| 17 | + |
| 18 | +This article explains how to enable resource-level diagnostic logging and how to find information about system and user operations on an Azure AI Search resource. |
| 19 | + |
| 20 | +## Prerequisites |
| 21 | + |
| 22 | +- An [Azure Log Analytics workspace](/azure/azure-monitor/logs/quick-create-workspace) in the same subscription. |
| 23 | + |
| 24 | +## Enable diagnostic logging |
| 25 | + |
| 26 | +Diagnostic logging is available through Azure Monitor. Although some logging, like Activity Logs and built-in metrics, is reported automatically with no upfront configuration, resource-level logs about in-service operations and data access require that you create a diagnostic setting and specify a storage option. |
| 27 | + |
| 28 | +1. Sign in to the [Azure portal](https://portal.azure.com) and navigate to your search service. |
| 29 | + |
| 30 | +1. Under **Monitoring** > **Diagnostic settings**, select **Add diagnostic setting**. |
| 31 | + |
| 32 | +1. Provide a name that identifies the service and level of logging, such as "my-search-service-all-logs" or "my-search-service-audit-logs". |
| 33 | + |
| 34 | +1. Under **Logs**, choose a category: |
| 35 | + |
| 36 | + - **Audit logs** capture user or app interactions with data or the settings of the service, but don't include user or groups identities. |
| 37 | + - **Operation logs** capture information about operations on a search service. |
| 38 | + - **allLogs** collect everything. |
| 39 | + |
| 40 | + Verbose logging can be expensive to store and complex to manage and store. You might want to start with **allLogs** and then switch to more scoped logging if it meets your information requirements. For more information about these categories, see [Diagnostic settings in Azure Monitor](/azure/azure-monitor/essentials/diagnostic-settings). |
| 41 | + |
| 42 | +1. For a destination, we recommend **Send to Log Analytics workspace** so that you can run Kusto queries against the data. There should be a workspace available |
| 43 | + |
| 44 | +1. Save the settings. |
| 45 | + |
| 46 | +Repeat these steps if you require a more [comprehensive data collection strategy](/azure/azure-monitor/logs/workspace-design). |
| 47 | + |
| 48 | +Each diagnostic setting you create requires its own data sink. If you use the Azure portal to review logs, the first diagnostic setting is used by default. You can navigate to specific workspaces for visualization support. |
| 49 | + |
| 50 | +> [!NOTE] |
| 51 | +> If you're using [key-based authentication](search-security-api-keys.md), Azure AI Search can't monitor individual user access to content on the search service. If you require this level of monitoring, you need to implement it in your client application. |
| 52 | +
|
| 53 | +## View logs in Log Analytics |
| 54 | + |
| 55 | +Follow these instructions to explore log analytics data for your resource. |
| 56 | + |
| 57 | +1. Under **Monitoring**, select **Logs**. Query hub opens by default. You can try the available queries, or close the hub and open a query window in KQL mode to run queries written in the [Kusto Query Language (KQL)](/kusto/query). |
| 58 | + |
| 59 | + :::image type="content" source="media/search-monitor-enable-logging/enable-kql-mode.png" alt-text="Screenshot of the KQL mode option in the Azure portal query explorer."::: |
| 60 | + |
| 61 | +1. In a query window, you can run Kusto queries against your logs. |
| 62 | + |
| 63 | + :::image type="content" source="media/search-monitor-enable-logging/query-example.png" alt-text="Screenshot of a query and results in the Azure portal."::: |
| 64 | + |
| 65 | +### Sample queries |
| 66 | + |
| 67 | +Here are a few basic Kusto queries you can use to explore your log data. |
| 68 | + |
| 69 | +Run this query for all diagnostic logs from Azure AI Search services over the specified time period: |
| 70 | + |
| 71 | +```kusto |
| 72 | +AzureDiagnostics |
| 73 | +| where ResourceProvider == "MICROSOFT.SEARCH" |
| 74 | +``` |
| 75 | + |
| 76 | +Run this query to see the 10 most recent logs: |
| 77 | + |
| 78 | +```kusto |
| 79 | +AzureDiagnostics |
| 80 | +| where ResourceProvider == "MICROSOFT.SEARCH" |
| 81 | +| take 10 |
| 82 | +``` |
| 83 | + |
| 84 | +Run this query to group operations by **Resource**: |
| 85 | + |
| 86 | +```kusto |
| 87 | +AzureDiagnostics |
| 88 | +| where ResourceProvider == "MICROSOFT.SEARCH" | |
| 89 | +summarize count() by Resource |
| 90 | +``` |
| 91 | + |
| 92 | +Run this query to find the average time it takes to perform an operation: |
| 93 | + |
| 94 | +```kusto |
| 95 | +AzureDiagnostics |
| 96 | +| where ResourceProvider == "MICROSOFT.SEARCH" |
| 97 | +| summarize avg(DurationMs) |
| 98 | +by OperationName |
| 99 | +``` |
| 100 | + |
| 101 | +Run this query to view the volume of operations over time split by OperationName with counts binned for every 10 seconds. |
| 102 | + |
| 103 | +```kusto |
| 104 | +AzureDiagnostics |
| 105 | +| where ResourceProvider == "MICROSOFT.SEARCH" |
| 106 | +| summarize count() |
| 107 | +by bin(TimeGenerated, 10s), OperationName |
| 108 | +| render areachart kind=unstacked |
| 109 | +``` |
0 commit comments