Share via

Query Packs - Create Or Update

Service:
Log Analytics
API Version:
2025-07-01

Creates (or updates) a Log Analytics QueryPack. Note: You cannot specify a different value for InstrumentationKey nor AppId in the Put operation.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/queryPacks/{queryPackName}?api-version=2025-07-01

URI Parameters

Name In Required Type Description
queryPackName
 path True

string

The name of the Log Analytics QueryPack resource.
resourceGroupName
 path True

string

minLength: 1
maxLength: 90

The name of the resource group. The name is case insensitive.
subscriptionId
 path True

string

minLength: 1

The ID of the target subscription.
api-version
 query True

string

minLength: 1

The API version to use for this operation.

Request Body

Name Required Type Description
location True

string

The geo-location where the resource lives
tags

object

Resource tags.

Responses

Name Type Description
200 OK

LogAnalyticsQueryPack

Successful request when creating or updating a Log Analytics QueryPack. The updated QueryPack is returned.
Other Status Codes

ErrorResponse

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

QueryPackCreate
QueryPackUpdate

QueryPackCreate

Sample request

PUT https://management.azure.com/subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4919/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/queryPacks/my-querypack?api-version=2025-07-01

{
  "location": "South Central US",
  "properties": {}
}

Sample response

Status code:
200 
{
  "id": "/subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4919/resourceGroups/my-resource-group/providers/microsoft.operationalinsights/queryPacks/my-querypack",
  "name": "my-querypack",
  "type": "microsoft.operationalinsights/querypacks",
  "location": "South Central US",
  "tags": {},
  "properties": {
    "queryPackId": "d1c8fc00-2b68-441e-8f9b-ded8748dc635",
    "timeCreated": "2019-08-04T12:37:56.8543652Z",
    "timeModified": "2019-08-04T12:37:56.8543652Z",
    "provisioningState": "Succeeded"
  }
}

QueryPackUpdate

Sample request

PUT https://management.azure.com/subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4919/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/queryPacks/my-querypack?api-version=2025-07-01

{
  "location": "South Central US",
  "tags": {
    "Tag1": "Value1"
  },
  "properties": {}
}

Sample response

Status code:
200 
{
  "id": "/subscriptions/86dc51d3-92ed-4d7e-947a-775ea79b4919/resourceGroups/my-resource-group/providers/microsoft.operationalinsights/queryPacks/my-querypack",
  "name": "my-querypack",
  "type": "microsoft.operationalinsights/querypacks",
  "location": "South Central US",
  "tags": {
    "Tag1": "Value1"
  },
  "properties": {
    "queryPackId": "aac8fc00-2b68-441e-8f9b-ded8748dc635",
    "timeCreated": "2019-06-04T12:37:56.8543652Z",
    "timeModified": "2019-08-04T12:37:56.8543652Z",
    "provisioningState": "Succeeded"
  }
}

Definitions

Name Description
createdByType

The type of identity that created the resource.
ErrorAdditionalInfo

The resource management error additional info.
ErrorDetail

The error detail.
ErrorResponse

Error response
LogAnalyticsQueryPack

An Log Analytics QueryPack definition.
systemData

Metadata pertaining to creation and last modification of the resource.

createdByType

Enumeration

The type of identity that created the resource.

Value Description
User
Application
ManagedIdentity
Key

ErrorAdditionalInfo

Object

The resource management error additional info.

Name Type Description
info

object

The additional info.
type

string

The additional info type.

ErrorDetail

Object

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.
code

string

The error code.
details

ErrorDetail[]

The error details.
message

string

The error message.
target

string

The error target.

ErrorResponse

Object

Error response

Name Type Description
error

ErrorDetail

The error object.

LogAnalyticsQueryPack

Object

An Log Analytics QueryPack definition.

Name Type Description
id

string (arm-id)

Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
location

string

The geo-location where the resource lives
name

string

The name of the resource
properties.provisioningState

string

Current state of this QueryPack: whether or not is has been provisioned within the resource group it is defined. Users cannot change this value but are able to read from it. Values will include Succeeded, Deploying, Canceled, and Failed.
properties.queryPackId

string

The unique ID of your application. This field cannot be changed.
properties.timeCreated

string (date-time)

Creation Date for the Log Analytics QueryPack, in ISO 8601 format.
properties.timeModified

string (date-time)

Last modified date of the Log Analytics QueryPack, in ISO 8601 format.
systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags

object

Resource tags.
type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string (date-time)

The timestamp of resource creation (UTC).
createdBy

string

The identity that created the resource.
createdByType

createdByType

The type of identity that created the resource.
lastModifiedAt

string (date-time)

The timestamp of resource last modification (UTC)
lastModifiedBy

string

The identity that last modified the resource.
lastModifiedByType

createdByType

The type of identity that last modified the resource.