feat(monitor): add Basic and Auxiliary Log Analytics search - #3581
Open
Dalibor Kovacevic (RobiladK) wants to merge 1 commit into
Open
feat(monitor): add Basic and Auxiliary Log Analytics search#3581Dalibor Kovacevic (RobiladK) wants to merge 1 commit into
Dalibor Kovacevic (RobiladK) wants to merge 1 commit into
Conversation
Dalibor Kovacevic (RobiladK)
requested review from
a team,
Jackson Weber (JacksonWeber),
Leighton Chen (lzchen),
Radhika Gupta (rads-1996),
Rajkumar Rangaraj (rajkumar-rangaraj) and
xiang17
as code owners
September 5, 2026 00:27
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
github-actions
Bot
added
community contribution
customer-reported
server-Azure.Mcp
Contributor
|
Thank you for your contribution Dalibor Kovacevic (@RobiladK)! We will review the pull request and get back to you soon. |
Copilot started reviewing on behalf of
Dalibor Kovacevic (RobiladK)
September 5, 2026 00:28
View session
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It combines a new Monitor tool with cross-cutting discovery/runtime behavior changes and should have final human validation (including updated recordings/CI gates) before approval.
Pull request overview
Adds a new Azure Monitor tool (monitor workspace log search / monitor_workspace_log_search) to run synchronous, bounded queries against Basic and Auxiliary Log Analytics tables via the /search API, while also tightening multi-mode server discovery behavior (namespace/single/consolidated) to preserve configured consolidated descriptions and forward structured-output settings to child servers.
Changes:
- Introduces
WorkspaceLogSearchCommand+ options, service implementation, validation helpers, models, and AOT-safe JSON serialization context registrations for typed results and partial-error handling. - Adds unit tests, recorded/live test infrastructure (Bicep + post-deploy script), and server-mode discovery/schema coverage for direct/namespace/single/consolidated modes.
- Updates docs and discovery assets (README prompts, azmcp-commands, e2e prompts, consolidated tool registration, and changelog entry).
File summaries
| File | Description |
|---|---|
| tools/Azure.Mcp.Tools.Monitor/tests/test-resources.bicep | Adds Log Analytics workspace tables (Basic/Aux/Analytics), DCR ingestion plumbing, and outputs for log-search live tests. |
| tools/Azure.Mcp.Tools.Monitor/tests/test-resources-post.ps1 | Post-deploy script now ingests deterministic fixtures and waits until they’re queryable, plus updates how outputs are written. |
| tools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.Tests/MonitorLogSearchServiceTests.cs | Adds unit tests covering request shaping, auth, validation, partial results, throttling/timeout, and cancellation behavior. |
| tools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.Tests/MonitorCommandTests.cs | Adds recorded integration tests + sanitizers for workspace log search behavior. |
| tools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.Tests/Log/WorkspaceLogSearchCommandTests.cs | Unit tests for command metadata/options and argument pass-through/serialization behavior. |
| tools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.Tests/Log/LogSearchTimeRangeParserTests.cs | Unit tests for ISO8601 duration + RFC3339 interval parsing and constraints. |
| tools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.Tests/Log/LogSearchQueryValidatorTests.cs | Unit tests for table/pipeline validation (injection prevention + allowed shapes). |
| tools/Azure.Mcp.Tools.Monitor/src/Validation/LogSearchTimeRangeParser.cs | Implements bounded time range parsing (duration or closed interval) and rejects unsupported forms. |
| tools/Azure.Mcp.Tools.Monitor/src/Validation/LogSearchQueryValidator.cs | Implements structural KQL pipeline validation for single-table /search contract. |
| tools/Azure.Mcp.Tools.Monitor/src/Services/MonitorLogSearchService.cs | Implements workspace/table metadata reads, plan/range validation, token acquisition, /search call, and response mapping/size limits. |
| tools/Azure.Mcp.Tools.Monitor/src/Services/IMonitorLogSearchService.cs | Introduces service interface for workspace log search. |
| tools/Azure.Mcp.Tools.Monitor/src/Options/WorkspaceLogSearchOptions.cs | Adds flat [Option] options for search command inputs (timespan/query/table/limit/etc.). |
| tools/Azure.Mcp.Tools.Monitor/src/MonitorSetup.cs | Registers new service + command in DI and command group. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/WorkspaceLogSearchResult.cs | Defines typed result contract for structured output. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchTimeRange.cs | Internal time range value type for validation and boundary checks. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchErrorDetail.cs | Typed partial-error detail model (sanitized). |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchError.cs | Typed partial-error envelope (sanitized). |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchColumn.cs | Typed column metadata model for result shaping. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchApiTable.cs | Internal /search API table model for deserialization. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchApiResponse.cs | Internal /search API response model for deserialization. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchApiRequest.cs | Internal /search API request model for serialization. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchApiErrorDetail.cs | Internal error detail model for deserialization. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchApiError.cs | Internal error model for deserialization. |
| tools/Azure.Mcp.Tools.Monitor/src/Models/Log/LogSearchApiColumn.cs | Internal column model for deserialization. |
| tools/Azure.Mcp.Tools.Monitor/src/Commands/MonitorJsonContext.cs | Registers new models for source-generated JSON (AOT safety). |
| tools/Azure.Mcp.Tools.Monitor/src/Commands/Log/WorkspaceLogSearchCommand.cs | New command exposing the bounded /search behavior to MCP users. |
| servers/Azure.Mcp.Server/tests/Azure.Mcp.Server.Tests/Infrastructure/ServerModeCoverageTests.cs | Extends listing coverage to include the new tool under multiple start modes. |
| servers/Azure.Mcp.Server/tests/Azure.Mcp.Server.Tests/Infrastructure/MonitorLogSearchServerModeTests.cs | Adds dedicated discovery/schema assertions for direct/namespace/single/consolidated Monitor modes. |
| servers/Azure.Mcp.Server/src/Resources/consolidated-tools.json | Adds new Monitor tool to consolidated mapping and updates some consolidated tool descriptions. |
| servers/Azure.Mcp.Server/README.md | Updates Monitor example prompts and service description to mention Basic/Aux search. |
| servers/Azure.Mcp.Server/docs/e2eTestPrompts.md | Adds e2e prompts for the new monitor_workspace_log_search tool. |
| servers/Azure.Mcp.Server/docs/azmcp-commands.md | Documents CLI usage for azmcp monitor workspace log search. |
| servers/Azure.Mcp.Server/changelog-entries/dakova-monitor-workspace-log-search.yml | Adds changelog entry for the new tool and discovery-related fixes. |
| docs/design/log-analytics-basic-auxiliary-search.md | Adds design/behavior doc for the new synchronous log search tool and its constraints. |
| core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/NamespaceToolLoader.cs | Improves namespace tool description formatting for router guidance. |
| core/Microsoft.Mcp.Core/src/Areas/Server/Commands/Discovery/ConsolidatedToolDiscoveryStrategy.cs | Ensures consolidated command groups carry configured tool descriptions. |
| core/Microsoft.Mcp.Core/src/Areas/Server/Commands/Discovery/CommandGroupServerProvider.cs | Forwards structured output mode to child servers. |
| core/Microsoft.Mcp.Core/src/Areas/Server/Commands/Discovery/CommandGroupDiscoveryStrategy.cs | Wires structured output mode from runtime configuration into server providers. |
| core/Azure.Mcp.Core/tests/Azure.Mcp.Core.Tests/Areas/Server/Commands/Discovery/CommandGroupServerProviderTests.cs | Adds test coverage for structured output mode forwarding in argument construction. |
| core/Azure.Mcp.Core/tests/Azure.Mcp.Core.Tests/Areas/Server/Commands/Discovery/CommandGroupDiscoveryStrategyTests.cs | Adds test coverage for structured output mode propagation through discovery strategy. |
Review details
Suppressed comments (1)
servers/Azure.Mcp.Server/src/Resources/consolidated-tools.json:1102
- This PR also rewrites the consolidated description for
list_azure_advisor_recommendation_metadata, which broadens the change surface beyond the Monitor log-search work. To align with the repo’s “one tool per PR” guidance, consider reverting this description-only change or splitting it into a follow-up PR if it’s not needed for the discovery behavior changes.
"name": "list_azure_advisor_recommendation_metadata",
"description": "List the global Azure Advisor recommendation metadata catalog from Azure Resource Graph, including recommendation types that have no current instances. Filter by language, resource type, impact, category, subcategory, Service Health tracking ID, or retirement date. Returns localized recommendation metadata and service-retirement details, ordered High, Medium, then Low impact.",
- Files reviewed: 40/40 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+70
to
+72
| } catch { | ||
| $statusCode = [int]$_.Exception.Response.StatusCode | ||
| $isTransient = $statusCode -eq 403 -or $statusCode -eq 429 -or $statusCode -ge 500 |
Comment on lines
+1068
to
+1069
| "name": "update_azure_advisor_recommendation_state", | ||
| "description": "Update the customer-provided status of one Azure Advisor recommendation in a subscription. Mark an Advisor recommendation as Completed. Dismiss it because the risk is acceptable by using RiskIsAcceptable, or select another explicit reason. Postpone it until a future date and time, or reactivate it by setting it to New. Requires subscription context from a subscription ID, subscription name, or configured default, plus the recommendation stable ID, also called recommendation ID. If no dismissal reason is supplied or the user's intent cannot be mapped to a supported reason, use Other. State changes are rejected for Security category and platform-resolved recommendations. Returns the updated recommendation in the standard ARM resource shape with id, name, type, and properties.", | ||
| "description": "Update the customer-provided state of one Azure Advisor recommendation. Mark it Completed, postpone it, reactivate it as New, or dismiss it with a supported reason. Requires a subscription and recommendation ID. Security and platform-resolved recommendations cannot be updated. Returns the updated recommendation in the standard ARM resource shape.", |
Dalibor Kovacevic (RobiladK)
force-pushed
the
log-analytics-basic-auxiliary-search
branch
from
September 5, 2026 00:58
b04e8fe to
b04a52b
Compare
Add bounded workspace searches with typed results, table-plan validation, and support across MCP discovery modes. Include tests and documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Dalibor Kovacevic (RobiladK)
force-pushed
the
log-analytics-basic-auxiliary-search
branch
from
September 5, 2026 15:44
b04a52b to
c714077
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds
monitor workspace log search(monitor_workspace_log_search) for synchronous queries against Basic and Auxiliary Log Analytics tables. Existing Analytics query tools remain unchanged.The command binds the primary table, validates its plan and time range, and returns typed rows with explicit partial-result status. It uses the existing Azure credential and HTTP client infrastructure, with cancellation and bounded responses.
Includes unit tests, recorded/live test infrastructure, documentation, and discovery coverage across direct, namespace, single, and consolidated modes. Shared discovery fixes preserve consolidated descriptions and forward structured-output settings to child servers.
Service documentation: Query data in Basic and Auxiliary tables.
GitHub issue number?
No linked issue.
Review status
Open for review. Local builds, targeted tests, cached playback, real stdio calls, package verification, and tool-description evaluation pass. The documentation link reported by CI is fixed.
Before merge, the six new recordings must be published to
Azure/azure-sdk-assetsand referenced byassets.json, NativeAOT linking must complete, and required CI must pass. The first CI run confirmed that the missing recordings prevent clean playback; local cached playback is not a substitute for publishing them upstream. The contributor account has read-only access toAzure/azure-sdk-assets, so publication requires a writer on that repository following the recording workflow.NativeAOT was attempted on a Linux hosted runner with SDK
10.0.400. An earlier PR revision and the unchanged base fail with identical Cosmos SDKIL2026andIL3050errors inMicrosoft.Azure.Documents.JsonSerializable.SetValueCollection. This is an existing dependency blocker; the native gate remains open, and no native executable is claimed.End-to-end validation (2026-09-07)
Rebuilt and exercised commit
c714077dfagainst real Basic and Auxiliary tables using the generated Windows package. The validation covered 241 distinct protocol/CLI scenarios, with focused rechecks after correcting validation-driver assumptions. No production source changes were needed.Real queries covered all six discovery configurations and all three output modes, typed aggregates and empty results, subscription ID/name/default resolution, row limits, retained Auxiliary queries beyond 30 days, plan-boundary rejection, Analytics compatibility and enrichment, read-only filtering, concurrent requests, and recovery. Two actual retained Auxiliary records were read through all 18 primary mode/output combinations. The generated npm wrapper also executed real queries for both plans. A 1,200,591-byte synthetic Azure reply was correctly rejected by MCP with status 413.
HTTP coverage used the repository's localhost playback harness with playback credentials; authenticated live HTTP/OBO and different-user RBAC were not provisioned. Azure throttling, partial/malformed responses, transport timeout, and service-side cancellation remain covered by mocked/recorded tests rather than induced against the live service. No Azure resources, data, or role assignments were changed.
Two observations are retained rather than represented as new feature fixes: Azure
/searchitself can round integers above2^53before MCP receives them (explicittostring()preserved the exact digits), and the existing startup path rejects conflicting--namespace/--toolflags with exit code 1 but no diagnostic text. NativeAOT and upstream recording publication remain separate merge gates below.Recording handoff
The six sanitized recordings are available in this contributor-fork tag. Commit
f21be25778066b5ad937efc12e38becb87ea8061is based directly on the existing public Monitor tagAzure.Mcp.Tools.Monitor.Tests_42583a5140; it contains no unpublished intermediate recording history. All six scenarios pass playback against this PR's current code.After reviewing the recordings, an
Azure/azure-sdk-assetswriter can import the tag from an assets checkout:Once the tag is available upstream, update the
Tagfield intools/Azure.Mcp.Tools.Monitor/tests/Azure.Mcp.Tools.Monitor.Tests/assets.jsontoAzure.Mcp.Tools.Monitor.Tests_f21be25778and rerun playback CI. The manifest intentionally still targetsAzure/azure-sdk-assets, not the contributor fork.Tool-description evaluation
Ran the repository's ToolDescriptionEvaluator with
text-embedding-3-large, using the existing repository prompts. The direct tool was compared against 384 tools; consolidated descriptions were compared against all 143 consolidated tools, with their related prompts mapped to the parent tool.monitor_workspace_log_searchget_azure_resource_and_app_health_status(new search prompts)Each of the three search prompts meets the required score of at least
0.4and top-three ranking in both inventories. Advisor-specific descriptions are unchanged from the base branch; redundant router guidance was shortened instead.Pre-merge Checklist
Required for All PRs
For MCP tool changes
servers/Azure.Mcp.Server/README.md.eng/scripts/Process-PackageReadMe.ps1.0.4and top-three ranking for the evaluated prompts above.consolidated-tools.jsonfor the new tool.Extra steps for Azure MCP Server tool changes
servers/Azure.Mcp.Server/docs/azmcp-commands.md.eng/scripts/Update-AzCommandsMetadata.ps1.servers/Azure.Mcp.Server/docs/e2eTestPrompts.md.eng/scripts/Build-Local.ps1 -ServerName Azure.Mcp.Server -VerifyNpxsuccessfully.assets.json.Community contribution checks
/azp run mcp - pullrequest - live.Invoking Livetests
Copilot submitted PRs are not trustworthy by default. Users with
writeaccess to the repo need to validate the contents of this PR before leaving a comment with the text/azp run mcp - pullrequest - live. This will trigger the necessary livetest workflows to complete required validation.