{"record":{"id":"a33f556272aa9878","repo":"wtfutil/wtf","slug":"failed-to-execute-query-on-workspace-s-w","errorCode":null,"errorMessage":"failed to execute query on workspace %s: %w","messagePattern":"failed to execute query on workspace (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/azurelogs/query.go","lineNumber":76,"sourceCode":"\t\t\tLogQueryClients[qf.SubscriptionID], err = CreateLogsClient(sess, qf.SubscriptionID)\n\t\t\tif err != nil {\n\t\t\t\tclientsMutex.Unlock()\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create Azure Logs client for subscription %s: %w\", qf.SubscriptionID, err)\n\t\t\t}\n\t\t}\n\t\tclient = LogQueryClients[qf.SubscriptionID]\n\t\tclientsMutex.Unlock()\n\t}\n\n\tres, err := client.QueryWorkspace(\n\t\tcontext.Background(),\n\t\tqf.WorkspaceID,\n\t\tazquery.Body{\n\t\t\tQuery: to.Ptr(qf.Query),\n\t\t},\n\t\tnil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to execute query on workspace %s: %w\", qf.WorkspaceID, err)\n\t}\n\n\tif res.Error != nil {\n\t\treturn nil, res.Error\n\t}\n\n\tswitch len(res.Tables) {\n\tcase 0:\n\t\treturn nil, fmt.Errorf(\"query returned no data tables: %s\", qf.Query)\n\tcase 1:\n\t\tif len(res.Tables[0].Columns) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"query returned table with no columns: %s\", qf.Query)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"query returned %d tables, expected 1: %s\", len(res.Tables), qf.Query)\n\t}\n\n\t// Process each row of data","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/wtfutil/wtf/blob/bb838c1ccb0f0f3223690df44afdec663d622881/modules/azurelogs/query.go#L58-L94","documentation":"RunQuery wraps the error returned by the Azure Log Analytics QueryClient's Query operation (Resources.Query on the workspace) with this message. The Azure SDK call itself failed — network error, HTTP error status, auth rejection, or invalid query/request body. The raw SDK error is preserved via %w.","triggerScenarios":"RunQuery or fetchDataAsync invoking client.Query(workspaceID, azquery.Body{Query: ...}, nil) when the HTTP request to the Log Analytics API fails: 401/403 auth failure, 400 invalid KQL, workspace not found, throttling (429), or network outage.","commonSituations":"KQL syntax error rejected with 400, token expired mid-run, workspace deleted or ID wrong, region/network egress blocked, or API throttling under heavy polling.","solutions":["Inspect the wrapped error for the HTTP status code and Azure error code to identify the root cause","Test the same KQL query manually in the Azure Portal Log Analytics query editor","Re-authenticate if the error indicates 401/expired token","Check workspace ID correctness and that the identity has Log Analytics Reader access","Add backoff/retry for 429 (throttled) responses"],"exampleFix":"// before\nres, err := client.Query(ctx, workspaceID, azquery.Body{Query: qf.Query}, nil)\n// after: validate the query and retry transient failures\nif isThrottlingError(err) { time.Sleep(backoff); res, err = client.Query(ctx, workspaceID, azquery.Body{Query: qf.Query}, nil) }","handlingStrategy":"retry","validationCode":"// validate KQL basics and workspace access before calling RunQuery\n// e.g. run a cheap `Heartbeat | take 1` probe query first\nprobeRes, err := client.Query(ctx, workspaceID, azquery.Body{Query: to.Ptr(\"Heartbeat | take 1\")}, nil)\nif err != nil { return fmt.Errorf(\"workspace unreachable: %w\", err) }","typeGuard":null,"tryCatchPattern":"var resp *azquery.QueryResponse\nfor attempt := 0; attempt < 3; attempt++ {\n    resp, err = RunQuery(sess)\n    if err == nil || !isRetryable(err) { break } // retry 429/5xx only\n    time.Sleep(time.Duration(1<<attempt) * time.Second)\n}","preventionTips":["Test KQL in the Azure Portal query editor before shipping it in config","Implement exponential backoff for 429/5xx responses","Keep tokens fresh; long-running jobs should re-create credentials on 401","Monitor Azure Log Analytics throttling limits for your workspace"],"tags":["azure","log-analytics","http","query-execution"],"backgroundTag":"azure-api-request-failed","analyzedSha":"bb838c1ccb0f0f3223690df44afdec663d622881","analyzedAt":"2026-09-03T17:02:45.030Z","contentChangedAt":"2026-09-03T17:02:45.030Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}