Azure Docs: Azure Log Analytics (#582)

Co-authored-by: Brian Rinaldi <brian.rinaldi@gmail.com>

Author: paolosalvatori

src/content/docs/azure/services/log-analytics.mdx

@@ -0,0 +1,206 @@
+---
+title: "Log Analytics"
+description: Get started with Azure Log Analytics on LocalStack
+template: doc
+---
+
+import AzureFeatureCoverage from "../../../../components/feature-coverage/AzureFeatureCoverage";
+
+## Introduction
+
+Azure Log Analytics Workspaces are the primary data store for Azure Monitor log data.
+They collect, index, and query log data from Azure resources, virtual machines, and custom sources. For more information, see [Log Analytics workspace overview](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview).
+They are commonly used as the central destination for diagnostic settings, Azure Monitor agents, and security audit logs in enterprise monitoring architectures.
+
+LocalStack for Azure provides a local environment for building and testing applications that make use of Azure Log Analytics Workspaces.
+The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of Log Analytics' integration with LocalStack.
+
+## Getting started
+
+This guide walks you through creating a Log Analytics Workspace, retrieving its shared keys, and deleting the workspace.
+
+Launch LocalStack using your preferred method. For more information, see [Introduction to LocalStack for Azure](/azure/getting-started/). Once the container is running, enable Azure CLI interception by running:
+
+```bash
+azlocal start-interception
+```
+
+This command points the `az` CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API.
+To revert this configuration, run:
+
+```bash
+azlocal stop-interception
+```
+
+This reconfigures the `az` CLI to send commands to the official Azure management REST API.
+
+### Create a resource group
+
+Create a resource group to hold all resources created in this guide:
+
+```bash
+az group create --name rg-laws-demo --location westeurope
+```
+
+```bash title="Output"
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-laws-demo",
+  "location": "westeurope",
+  "name": "rg-laws-demo",
+  "properties": { "provisioningState": "Succeeded" },
+  "type": "Microsoft.Resources/resourceGroups"
+}
+```
+
+### Create a Log Analytics Workspace
+
+Create a Log Analytics workspace with a 30-day data retention period (matching the default for `--retention-time` in the [Azure CLI workspace create](https://learn.microsoft.com/en-us/cli/azure/monitor/log-analytics/workspace?view=azure-cli-latest#az-monitor-log-analytics-workspace-create) reference):
+
+```bash
+az monitor log-analytics workspace create \
+  --name my-workspace \
+  --resource-group rg-laws-demo \
+  --location westeurope \
+  --retention-time 30
+```
+
+```bash title="Output"
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-laws-demo/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
+  "location": "westeurope",
+  "name": "my-workspace",
+  "resourceGroup": "rg-laws-demo",
+  "type": "Microsoft.OperationalInsights/workspaces",
+  "properties": {
+    "customerId": "a1b2c3d4-e5f6-4789-a012-3456789abcd0",
+    "provisioningState": "Succeeded",
+    "publicNetworkAccessForIngestion": "Enabled",
+    "publicNetworkAccessForQuery": "Enabled",
+    "retentionInDays": 30,
+    "sku": { "name": "PerGB2018" }
+  }
+}
+```
+
+### Retrieve workspace shared keys
+
+Retrieve the primary and secondary shared keys used to send logs directly to the workspace:
+
+```bash
+az monitor log-analytics workspace get-shared-keys \
+  --workspace-name my-workspace \
+  --resource-group rg-laws-demo
+```
+
+```bash title="Output"
+{
+  "primarySharedKey": "ZW5jb2RlZFNoYXJlZEtleUV4YW1wbGUxMjM0NTY3OA==",
+  "secondarySharedKey": "c2Vjb25kYXJ5U2hhcmVkS2V5RXhhbXBsZTk4NzY1NDMyMQ=="
+}
+```
+
+### List workspaces
+
+List all Log Analytics workspaces in the resource group:
+
+```bash
+az monitor log-analytics workspace list \
+  --resource-group rg-laws-demo
+```
+
+```bash title="Output"
+[
+  {
+    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-laws-demo/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
+    "location": "westeurope",
+    "name": "my-workspace",
+    "resourceGroup": "rg-laws-demo",
+    "type": "Microsoft.OperationalInsights/workspaces",
+    "properties": {
+      "customerId": "a1b2c3d4-e5f6-4789-a012-3456789abcd0",
+      "provisioningState": "Succeeded",
+      "retentionInDays": 30,
+      "sku": { "name": "PerGB2018" }
+    }
+  }
+]
+```
+
+### Show a workspace
+
+Retrieve the full details of the workspace, including its unique customer ID:
+
+```bash
+az monitor log-analytics workspace show \
+  --workspace-name my-workspace \
+  --resource-group rg-laws-demo
+```
+
+```bash title="Output"
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-laws-demo/providers/Microsoft.OperationalInsights/workspaces/my-workspace",
+  "location": "westeurope",
+  "name": "my-workspace",
+  "resourceGroup": "rg-laws-demo",
+  "type": "Microsoft.OperationalInsights/workspaces",
+  "properties": {
+    "customerId": "a1b2c3d4-e5f6-4789-a012-3456789abcd0",
+    "provisioningState": "Succeeded",
+    "publicNetworkAccessForIngestion": "Enabled",
+    "publicNetworkAccessForQuery": "Enabled",
+    "retentionInDays": 30,
+    "sku": { "name": "PerGB2018" }
+  }
+}
+```
+
+### Delete and verify
+
+Delete the resource and confirm it no longer appears in the list:
+
+```bash
+az monitor log-analytics workspace delete \
+  --workspace-name my-workspace \
+  --resource-group rg-laws-demo \
+  --yes
+```
+
+
+Then list all workspaces to confirm the resource group is now empty:
+
+```bash
+az monitor log-analytics workspace list \
+  --resource-group rg-laws-demo
+```
+
+```bash title="Output"
+[]
+```
+
+## Features
+
+- **Workspace lifecycle:** Create, read, list, update, and delete Log Analytics Workspaces.
+- **Shared key retrieval:** Retrieve primary and secondary shared keys via `get-shared-keys`.
+- **SKU configuration:** Accept `PerGB2018`, `Free`, `Standard`, `Premium`, `PerNode`, and `Standalone` SKUs (Azure's REST API also defines `CapacityReservation` and `LACluster`; see [WorkspaceSkuNameEnum](https://learn.microsoft.com/en-us/rest/api/loganalytics/workspaces/create-or-update#workspaceskunameenum) in the Azure REST reference).
+- **Retention configuration:** Configure log retention period in days.
+- **Activity Logs:** Activity log events generated by LocalStack operations are fully emulated and queryable via the Activity Log API.
+
+## Limitations
+
+- **No log ingestion:** Data sent to the legacy [HTTP Data Collector API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api) or other ingestion endpoints is not stored.
+- **No KQL query execution:** Running `az monitor log-analytics query` is not supported.
+- **No table or schema management:** Custom tables, table schemas, and retention policies per table are not managed.
+- **No saved searches:** Saved queries and search functions are not supported.
+- **No linked services:** Linking Automation accounts or [Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) to a workspace is not emulated.
+- **No Microsoft Sentinel:** Sentinel and related SIEM workspace features are not emulated.
+
+## Samples
+
+The following sample demonstrates how to use Azure Log Analytics with LocalStack for Azure:
+
+- [Function App and Service Bus](https://github.com/localstack/localstack-azure-samples/samples/function-app-service-bus/dotnet/README.md)
+- [Web App and Cosmos DB for MongoDB API](https://github.com/localstack/localstack-azure-samples/samples/web-app-cosmosdb-mongodb-api/python/README.md)
+
+## API Coverage
+
+<AzureFeatureCoverage service="Microsoft.OperationalInsights" client:load />