Schema - Get

Service:: Log Analytics

API Version:: 2025-07-01

Gets the schema for a given workspace.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/schema?api-version=2025-07-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
workspaceName	path	True	string minLength: 4 maxLength: 63 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	SearchGetSchemaResponse	OK response definition.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

WorkspacesGetSchema

POST https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/atlantisdemo/schema?api-version=2025-07-01

from azure.identity import DefaultAzureCredential

from azure.mgmt.loganalytics import LogAnalyticsManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-loganalytics
# USAGE
    python saved_searches_get_schema.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = LogAnalyticsManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="00000000-0000-0000-0000-00000000000",
    )

    response = client.schema.get(
        resource_group_name="mms-eus",
        workspace_name="atlantisdemo",
    )
    print(response)


# x-ms-original-file: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/OperationalInsights/stable/2025-07-01/examples/SavedSearchesGetSchema.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "metadata": {
    "schema": {
      "name": "CloudOps",
      "version": 2
    },
    "resultType": "schema",
    "requestTime": 28
  },
  "value": [
    {
      "name": "TenantId",
      "displayName": "TenantId",
      "type": "Guid",
      "indexed": true,
      "stored": false,
      "facet": false,
      "ownerType": [
        "Alert",
        "AzureActivity",
        "AzureAudit",
        "AzureMetrics",
        "ComputerGroup",
        "ETWEvent",
        "Event",
        "ExtraHopDBLogin",
        "ExtraHopDBTransaction",
        "ExtraHopDNSResponse",
        "ExtraHopFTPResponse",
        "ExtraHopHTTPTransaction",
        "ExtraHopSMTPMessage",
        "ExtraHopSYNScanDetect",
        "ExtraHopTCPOpen",
        "Heartbeat",
        "Operation",
        "Perf",
        "ReservedAzureCommonFields",
        "ReservedCommonFields",
        "ServiceFabricOperationalEvent",
        "ServiceFabricReliableActorEvent",
        "ServiceFabricReliableServiceEvent",
        "Syslog",
        "Usage",
        "W3CIISLog"
      ]
    }
  ]
}

Definitions

Name	Description
CoreSummary	The core summary of a search.
SearchGetSchemaResponse	The get schema operation response.
SearchMetadata	Metadata for search results.
SearchMetadataSchema	Schema metadata for search.
SearchSchemaValue	Value object for schema results.
SearchSort	The sort parameters for search.
SearchSortEnum	The sort order of the search.

CoreSummary

Object

The core summary of a search.

Name	Type	Description
numberOfDocuments	integer (int64)	The number of documents of a core summary.
status	string	The status of a core summary.

SearchGetSchemaResponse

Object

The get schema operation response.

Name	Type	Description
metadata	SearchMetadata	The metadata from search results.
value	SearchSchemaValue[]	The array of result values.

SearchMetadata

Object

Metadata for search results.

Name	Type	Description
aggregatedGroupingFields	string	The aggregated grouping fields.
aggregatedValueField	string	The aggregated value field.
coreSummaries	CoreSummary[]	The core summaries.
eTag	string	The ETag of the search results.
id	string	The id of the search results request.
lastUpdated	string (date-time)	The time of last update.
max	integer (int64)	The max of all aggregates returned in the result set.
requestId	string	The request id of the search.
requestTime	integer (int64)	The request time.
resultType	string	The search result type.
schema	SearchMetadataSchema	The schema.
sort	SearchSort[]	How the results are sorted.
startTime	string (date-time)	The start time for the search.
status	string	The status of the search results.
sum	integer (int64)	The sum of all aggregates returned in the result set.
top	integer (int64)	The number of top search results.
total	integer (int64)	The total number of search results.

SearchMetadataSchema

Object

Schema metadata for search.

Name	Type	Description
name	string	The name of the metadata schema.
version	integer (int32)	The version of the metadata schema.

SearchSchemaValue

Object

Value object for schema results.

Name	Type	Description
displayName	string	The display name of the schema.
facet	boolean	The boolean that indicates whether or not the field is a facet.
indexed	boolean	The boolean that indicates the field is searchable as free text.
name	string	The name of the schema.
ownerType	string[]	The array of workflows containing the field.
stored	boolean	The boolean that indicates whether or not the field is stored.
type	string	The type.

SearchSort

Object

The sort parameters for search.

Name	Type	Description
name	string	The name of the field the search query is sorted on.
order	SearchSortEnum	The sort order of the search.

SearchSortEnum

Enumeration

The sort order of the search.

Value	Description
asc
desc

Share via

Schema - Get

URI Parameters

Responses

Security

azure_auth

Scopes

Examples

WorkspacesGetSchema

Sample request

Sample response

Definitions

CoreSummary

SearchGetSchemaResponse

SearchMetadata

SearchMetadataSchema

SearchSchemaValue

SearchSort

SearchSortEnum