I want to create a clean and optimized KQL query in Azure Log Analytics to show only the status/health of Azure Event Hub Namespaces.

Question

I want to create a clean and optimized KQL query in Azure Log Analytics to show only the status/health of Azure Event Hub Namespaces.

Amit Kumar 0

The query should:

Display Event Hub Namespace name
Show current status/availability
Indicate whether the namespace is Healthy, Unavailable, or Failed

Smaran Thoomu 35,375 Reputation points Moderator

2026-05-27T02:39:59.9333333+00:00
@Amit Kumar Hi Amit Kumar,

Thanks for reaching out — I understand you're looking to create a clean and optimized KQL query to display Azure Event Hub Namespace health. To help diagnose this, I need a few more details:

Which Log Analytics table are you querying for Event Hub Namespace health (e.g., AzureDiagnostics, AzureMetrics, or another)?

What specific fields or columns in your logs represent the namespace status and health?

Could you provide a sample log entry or data snippet that shows how the health/status appears?

Have you already tried any KQL queries? If so, please share your attempted code and describe what output you received.

Once you share these details, I can suggest specific next steps.

Thanks!

2 answers

Your answer

Smaran Thoomu 35,375 Reputation points Moderator

2026-05-27T02:39:59.9333333+00:00

@Amit Kumar Hi Amit Kumar,

Thanks for reaching out — I understand you're looking to create a clean and optimized KQL query to display Azure Event Hub Namespace health. To help diagnose this, I need a few more details:

Which Log Analytics table are you querying for Event Hub Namespace health (e.g., AzureDiagnostics, AzureMetrics, or another)?

What specific fields or columns in your logs represent the namespace status and health?

Could you provide a sample log entry or data snippet that shows how the health/status appears?

Have you already tried any KQL queries? If so, please share your attempted code and describe what output you received.

Once you share these details, I can suggest specific next steps.

Thanks!

Answer 1

kagiyama yutaka 5,085

I think the health for Event Hub namespaces is taken from the public HealthResources table and its availabilityState, and KQL can show the namespace name and that state by filtering Microsoft.EventHub/namespaces.

0 comments

Answer 2

Use Azure Resource Graph with the Azure Resource Health table to get the availability state of Event Hubs namespaces.

Example KQL (for Azure Resource Graph / Log Analytics with HealthResources):

HealthResources
| where type =~ 'microsoft.resourcehealth/availabilitystatuses'
// Keep only Event Hubs namespaces
| where tostring(properties.targetResourceType) =~ 'Microsoft.EventHub/namespaces'
// Extract fields of interest
| extend 
    NamespaceName = tostring(properties.targetResourceName),
    AvailabilityState = tostring(properties.availabilityState)
// Map availability state to a simple health label
| extend HealthStatus = case(
    AvailabilityState =~ 'Available', 'Healthy',
    AvailabilityState =~ 'Unavailable', 'Unavailable',
    AvailabilityState =~ 'Degraded', 'Degraded',
    AvailabilityState =~ 'Unknown', 'Unknown',
    'Failed')
// Select and sort columns
| project NamespaceName, AvailabilityState, HealthStatus, subscriptionId
| order by NamespaceName asc

Explanation of columns:

NamespaceName: Event Hub Namespace name.
AvailabilityState: Raw Azure Resource Health state.
HealthStatus: Simplified status label (Healthy / Unavailable / Failed/Degraded/Unknown).

Run this query via Azure Resource Graph (for example with az graph query or Search-AzGraph) or in any Log Analytics context where the HealthResources table is available.

References: