In Azure log analytics - where are the delete queries in KQL?

Question

All queries in CDBQueryRuntimeStatistics seems to be select queries.

CDBQueryRuntimeStatistics
| where not( QueryText startswith '{"query":"SELECT' )

returns nothing. I thought I would have Delete in there somewhere.

Answer 1

Azure cosmos dB NoSQL Api provides only select query. We cannot delete using queries. The reason why CDBDataPlaneRequests has captured delete operation, may be of delete operation that is done with rest or C# code on cosmos dB data. CDBDataPlaneRequests captures all operations done on cosmos dB data. But CDBQueryRuntimeStatistics logs all the query operations only.

CDBDataPlaneRequests: The DataPlaneRequests table captures every data plane operation for the Cosmos DB account. Data Plane requests are operations executed to create, update, delete or retrieve data within the account.

CDBQueryRuntimeStatistics: This table details query operations executed against a SQL API account. By default, the query text and its parameters are obfuscated to avoid logging PII data with full text query logging available by request.

This may be the reason for data getting logged in CDBDataPlaneRequests and not in CDBQueryRuntimeStatistics log.

Reference:

1. https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/cdbqueryruntimestatistics
2. https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/cdbdataplanerequests