Azure Log Analytics Workspace Python查询BadArgumentError报错求助

你的代码在拼接查询时犯了KQL逻辑顺序错误：

原log_query已经通过summarize count() by Computer对数据做了聚合，聚合后的结果集只包含Computer和count_两列，不再存在TimeGenerated列。但你又在聚合之后拼接了一段where TimeGenerated >= ...的过滤条件，导致KQL无法找到TimeGenerated列，触发语义错误。

拼接后的完整错误查询如下：

Heartbeat
| where TimeGenerated > ago(1h)
| summarize count() by Computer
| where TimeGenerated >= datetime(202X-XX-XXTXX:XX:XXZ) and TimeGenerated <= datetime(202X-XX-XXTXX:XX:XXZ)

有两种可行的修正方式：

方式一：利用timespan参数自动过滤（推荐） #

LogsQueryClient的query_workspace方法已提供timespan参数，会自动过滤TimeGenerated在指定范围内的数据，无需手动在KQL中拼接时间条件。直接去掉代码中拼接的where语句即可：

def query_logs():
    credential = authenticate()
    try:
        logs_query_client = LogsQueryClient(credential)
        end_time = datetime.utcnow()
        start_time = end_time - time_range
        # 直接使用原log_query，不再拼接额外的where条件
        query = log_query
        timespan = (start_time, end_time)
        response = logs_query_client.query_workspace(monitor_resource_id, query, timespan=timespan)
        for table in response.tables:
            for row in table.rows:
                print(row)
    
    except HttpResponseError as e:
        print(f"HTTP Response Error: {e.message}")
        print(f"Response status code: {e.status_code}")
        print(f"Error details: {e.error}")
    except Exception as e:
        print(f"An error occurred: {e}")

方式二：手动将时间过滤放在聚合之前 #

如果一定要手动写时间过滤逻辑，需把拼接的where条件放到summarize之前，确保过滤时TimeGenerated列仍存在：

def query_logs():
    credential = authenticate()
    try:
        logs_query_client = LogsQueryClient(credential)
        end_time = datetime.utcnow()
        start_time = end_time - time_range
        # 定义时间过滤语句
        time_filter = f"| where TimeGenerated >= datetime({start_time.strftime('%Y-%m-%dT%H:%M:%SZ')}) and TimeGenerated <= datetime({end_time.strftime('%Y-%m-%dT%H:%M:%SZ')})"
        # 拆分原查询，在summarize行前插入时间过滤
        log_query_lines = log_query.strip().split('\n')
        for i, line in enumerate(log_query_lines):
            if 'summarize' in line:
                log_query_lines.insert(i, time_filter)
                break
        query = '\n'.join(log_query_lines)
        timespan = (start_time, end_time)
        response = logs_query_client.query_workspace(monitor_resource_id, query, timespan=timespan)
        for table in response.tables:
            for row in table.rows:
                print(row)
    
    except HttpResponseError as e:
        print(f"HTTP Response Error: {e.message}")
        print(f"Response status code: {e.status_code}")
        print(f"Error details: {e.error}")
    except Exception as e:
        print(f"An error occurred: {e}")

内容的提问来源于stack exchange，提问作者vaibhav