Navigate back to the homepage

Working with Tags in Azure Resource Graph Explorer

John Kilmister
February 28th, 2021 · 1 min read

Azure Resource Graph Explorer is a great tool for querying your Azure resources. Through queries, you can quickly produce tables and charts that can then either be downloaded or displayed on an Azure Dashboard. The queries are written in Kusto Query Language (KQL) and many example queries can be found on the Microsoft Docs website. One of the less intuitive scenarios however arises when working with tags.

Tag Queries

When you create a query that returns tags the data comes back as a block of JSON inside a single column. This means you cannot filter, or aggregate data based on a individual tags.

Screenshot of quick query with Azure Graph Explorer

Using mvexpand

The first step in solving this issue is the mvexpand operator. This operator is the opposite of the summarize operator and will break out each tag into separate rows.

1ResourceContainers
2| where type =~ 'microsoft.resources/subscriptions/resourcegroups'
3| mvexpand tags
4| project name, tags

Screenshot of quick query with Azure Grpah Explorer

At this point however, the data is still in JSON and you cannot apply any further checks on it or use it in graphs.

Using extend

The next step is to use the extend operator. This operator is used to add calculated columns to your result set. In our case using this will allow us to read the JSON data from the expand and format it so it becomes plain text.

1ResourceContainers
2| where type =~ 'microsoft.resources/subscriptions/resourcegroups'
3| mvexpand tags
4| extend tagKey = tostring(bag_keys(tags)[0])
5| extend tagValue = tostring(tags[tagKey])
6| project name, tags, tagKey, tagValue

Screenshot of mvexpand being used

Tag Filters

Now the tag data is in plain text columns we can filter to discard values and then apply a group on the values. The resulting data can be shown as a chart can be pinned to an Azure dashboard.

1ResourceContainers
2| where type =~ 'microsoft.resources/subscriptions/resourcegroups'
3| mvexpand tags
4| extend tagKey = tostring(bag_keys(tags)[0])
5| extend tagValue = tostring(tags[tagKey])
6| where tagKey =~ "Team"
7| summarize count() by tagValue

Screenshot of Azure Grpah Explorer chart using tags

Summary

Azure Resource Graph Explorer is a powerful tool however in some queries it will return JSON data inside a single column. In this post we looked at how can use the mvexpand and extend operators to take JSON columns and extract both the key and values. From this we are then able to filter and aggregate the data to create charts.

If you enjoyed reading please share...

More articles from John kilmister

An Introduction to Azure Static WebApps

Azure Static Web Apps add first class support for modern, fast and responsive websites inside the Azure portal. The integration allows you…

February 9th, 2021 · 4 min read

OAuth Device Flow for IoT with the Microsoft Graph API

Device code flow is a flow for browserless and input constrained devices that can be used by your applications on IoT devices

January 28th, 2021 · 3 min read
© 2009–2021 John kilmister
Link to $https://twitter.com/johnkilmisterLink to $https://github.com/blueboxesLink to $https://stackoverflow.com/users/33/johnLink to $https://www.linkedin.com/in/johnkilmister/