How to call rest api from loganalytics workspace to query Usages - List By Vaults api

Hi Siva, thanks for reaching out Microsoft Q&A

Log Analytics workspaces (Kusto) cannot directly call external REST APIs. The query engine only works against ingested data already in your workspace.

If you want to bring Backup Vault usage data into your Log Analytics workspace, you have two options to follow

Call REST API from Log Analytics Workspace

• First, register an application in Azure AD, assign it the Log Analytics Reader role on the target workspace, and create a client secret. Then, use the app’s client ID, secret, and tenant ID to request an OAuth2 token from Azure AD’s token endpoint, specifying https://api.loganalytics.azure.com as the resource.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/register-app-for-token?tabs=portal

• To query Log Analytics through the REST API, use the endpoint https://api.loganalytics.azure.com/v1/workspaces/{workspaceId}/query and authenticate with a bearer token obtained via Microsoft Entra ID (OAuth2 client credentials flow.
• You then send your Kusto query in JSON format (e.g., { "query": "Usage" }) in a POST request, including the token in the Authorization header.
• The Usages – List By Vaults API is specific to Azure Backup. Vault usage metrics can be obtained directly in Log Analytics by running the right Kusto queries against data already ingested into the workspace.
• Alternatively, you can call the Azure Backup REST API (a separate endpoint) using an Azure AD token for authentication, and if you want to integrate those results with Log Analytics, you can push the retrieved backup data into the workspace for querying.

Refer document: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api?tabs=rest

Sending Email or Alerts from Log Analytics Workspace

• Sending emails directly from a Log Analytics workspace isn’t supported. Instead, you can create alert rules on your Log Analytics queries and attach action groups, which handle the notifications. Action groups let you send emails, SMS, or trigger webhooks when the alert condition is met, ensuring query results automatically generate the required notifications.

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview

As Divyesh Govaerdhanan mentioned you can also use

• A Logic App or Azure Function to call the Usages - ListByVaults REST API and push the results into your Log Analytics workspace through the Data Collector API. Since Kusto cannot make REST calls directly, the data must be ingested either via diagnostic settings or a custom pipeline before you can query it.

https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/logs/data-collector-api?utm_source

I hope this resolves your issue. If you have any additional questions, please don’t hesitate to reach out. I’ll be glad to help.