I would like to create a monitoring dashboard using data from Azure Log Analytics Workspace.

Welcome to Microsoft Q&A.

@Gaddam Danam Hanok

I hope you are doing well.

Azure Monitor Workbooks would be a good fit for this scenario. They allow you to use KQL against Log Analytics data and combine the results into charts, grids, KPIs, and interactive filters. ([Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-data-sources?utm_source=chatgpt.com"Azure Workbooks data sources - Azure Monitor | Microsoft Learn"))

I would suggest starting with a simple structure:

1. Define the KPIs you want to monitor — for example, availability, errors, CPU/memory, failed requests, alerts, or security events.
2. Build and test the KQL queries in Log Analytics first.
3. Create an Azure Monitor Workbook and add each query as a separate visualization.
4. Add parameters such as time range, subscription, resource group, and resource so users can filter the dashboard interactively. ([Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-interactive-reports?utm_source=chatgpt.com"Create interactive reports with Azure Monitor Workbooks - Azure Monitor | Microsoft Learn"))
5. Save and share the Workbook with the appropriate Azure RBAC permissions.

For example, a basic query could look like:

AzureActivity

| where TimeGenerated > ago(24h)

| summarize Events = count() by CategoryValue

| order by Events desc

You can then visualize the result as a bar or pie chart.

For performance, avoid querying unnecessarily large time ranges or raw datasets. Microsoft recommends using appropriate time ranges and aggregating data before visualization where possible. ([Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-create-workbook?utm_source=chatgpt.com"Create or edit an Azure Workbook - Azure Monitor | Microsoft Learn"))

I would generally choose Workbooks over Azure Dashboards when the goal is an interactive monitoring/reporting solution based heavily on KQL. Azure Dashboards are better suited to a simpler "single pane of glass," while Workbooks provide richer querying, parameters, and interactive visualizations. ([Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/best-practices-visualize?utm_source=chatgpt.com"Azure Monitor best practices - Analysis and visualizations - Azure Monitor | Microsoft Learn"))

Useful documentation

Azure Workbooks overview https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

Create or edit an Azure Workbook https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-create-workbook

Workbook data sources https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-data-sources

Azure Monitor visualization best practices https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/best-practices-visualize

If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

Hi @Gaddam Danam Hanok Welcome to Microsoft Q&A

Designing the Dashboard:

• Define objectives first: Decide what you want to monitor (e.g., VM performance, application logs, security events).

• Group by theme: Organize metrics into logical sections (infrastructure, application, security).

• Keep it actionable: Each visualization should answer a specific operational or business question.

KQL Query Best Practices:

• Start simple: Begin with queries that return key metrics (CPU %, memory usage, request counts).

• Use summarization:

Perf

| where ObjectName == "Processor" and CounterName == "% Processor Time"

| summarize avg(CounterValue) by bin(TimeGenerated, 5m), Computer

• Apply filters early: Narrow down by resource group, subscription, or tags to reduce noise.

• Leverage joins: Combine tables (e.g., AzureDiagnostics with Heartbeat) for richer insights.

• Parameterize queries: Use workbook parameters (like time range, resource selection) to make dashboards reusable.

Configuring Visualizations:

Choose the right chart

• Line charts → trends over time

• Bar charts → comparisons

• Pie charts → distribution

• Grids → tabular logs

• Use thresholds: Highlight anomalies with conditional formatting.

• Drill‑downs: Configure links from summary charts to detailed queries.

Publishing Results:

Azure Monitor Workbooks:

• Best for interactive, multi‑section dashboards.

• Support parameters, rich visuals, and narrative text.

• Shareable with RBAC permissions.

Azure Dashboards:

• Lightweight, pin individual charts or queries.

• Good for quick overviews but less flexible than Workbooks.

Recommendations:

1. Start with Workbooks for flexibility and richer visualization.
2. Use templates: Azure provides workbook templates for common scenarios (VM health, Application Insights, Security).
3. Iterate with stakeholders: Build dashboards collaboratively to ensure they meet operational needs.
4. Automate deployment: Store workbook JSON in source control and deploy via ARM/Bicep/Terraform for consistency.
5. Monitor performance: Keep queries efficient; avoid overly broad scans that slow down dashboards.

Reference:

https://learn.microsoft.com/azure/data-explorer/kql-quick-reference

https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

https://learn.microsoft.com/en-us/azure/azure-portal/azure-portal-dashboards

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution

Hello Gaddam Danam Hanok

Thank you for posting your query on Microsoft Q&A platform.

For a monitoring dashboard built on Log Analytics data, I'd recommend using Azure Monitor Workbooks as your primary canvas, and then pinning a few summary tiles to an Azure Dashboard if you also need an at-a-glance view for the wider team. Workbooks give you parameters, drill-downs, and multiple data sources in one place, whereas Azure Dashboards are better suited to static tiles.

1. Choosing where to build it:

Workbooks let you combine text, log queries, metrics, and parameters into a single interactive report, and you can reach them from Monitor > Workbooks or directly from the Workbooks blade inside your Log Analytics workspace. There's also a Public Templates gallery with ready-made templates from Microsoft, which is usually the fastest way to start rather than building from a blank canvas.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

One thing worth knowing upfront if you go the Azure Dashboard route: when you pin a log query, only these render types are supported — areachart, columnchart, piechart (shown as a donut), scatterchart, and timechart. Anything outside that list won't pin cleanly.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/tutorial-logs-dashboards

2. Designing the layout:

A structure that works well in practice:

• Top row: parameters — Subscription, Resource Group, Resource, and Time Range. Workbooks supports Azure Resource Graph as a data source specifically for building these resource pickers.
• Second row: KPI / stat tiles (availability, error rate, active alerts).
• Middle: time-series charts for trends.
• Bottom: grids for drill-down detail, with link actions so operators can jump straight to the resource.

Supported visual types include charts, grids, tiles, trees, honeycomb, stat, graphs, maps, and text. Note that each visualization and data source has its own limits, so it's worth checking that before designing very large grids.

References:

• Data sources: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-data-sources
• Visualizations: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-visualizations

3. Writing efficient KQL.

This is the part that matters most, because dashboards re-run their queries constantly. Microsoft specifically calls out dashboards, alerts, Logic Apps and Power BI as recurrent, simultaneous consumers where an inefficient query has a substantial impact.

A few high-value rules:

• Filter as early as possible with where to cut the volume being processed.
• Use has instead of contains when matching full tokens.
• Prefer case-sensitive operators (== over =~, in over in~).
• Avoid * in searches — it forces a full-text scan across every column. Target a specific column instead.
• Keep datetime values in the datetime type rather than long.
• For rare keys inside dynamic columns, pre-filter first (| where Col has "value" | where Col.Key == "value") so JSON parsing only runs on what's left.
• Use materialize() when a let value is referenced more than once.

References:

• KQL best practices: https://learn.microsoft.com/en-us/kusto/query/best-practices
• Optimize log queries: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-optimization

A sample starter query for a CPU trend tile:

Perf
| where TimeGenerated > ago(24h)
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize avg(CounterValue) by bin(TimeGenerated, 5m), Computer
| render timechart

If your queries span large datasets or long time ranges, use Summary Rules. They aggregate data as it arrives into a summary table, and querying that summarized table instead of the raw tables noticeably improves performance and reduces timeouts. Same doc as above covers this.

To validate performance, run your query in Log Analytics and click Query details at the bottom right — it shows key performance indicators, raw execution statistics, and any errors.

4. Publishing and sharing.

For a Workbook: Save it to a subscription, resource group, and region, then share it — access is governed by Azure RBAC on the workbook resource. You can also promote it to a template so other teams can deploy their own copy.

For an Azure Dashboard:

1. Go to Dashboard > New dashboard — it's private by default.
2. Name it, then select Done customizing.
3. Run your query in Logs, then use Pin to > Azure dashboards.
4. Select Share, pick a subscription and resource group (the guided pattern places these in a resource group named dashboards), and select Publish.

Access to the data shown on the dashboard is controlled through Azure RBAC.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/tutorial-logs-dashboards

If you also need business-facing reporting, you can export from Logs into Power BI. You'll need Microsoft.OperationalInsights/workspaces/query/*/read (Log Analytics Reader) to export as an M query, or Microsoft.OperationalInsights/workspaces/write (Log Analytics Contributor) to create a dataset directly in the Power BI service.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-powerbi

If the Pin to dashboard option is greyed out with "Pin to Dashboard is not supported in this environment", that's expected behaviour when a customer-managed key is enabled for saved queries, which requires a linked storage account on the workspace. Removing the linked storage account restores the pin option.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys

I hope the details shared above helped in addressing your concern.

If the suggested resolution resolved the issue, kindly consider marking the answer as "Accepted" and "Upvote" it. This helps other community members who may encounter a similar issue in the future.

If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

Thanks,
Suchitra.