How to build Azure Monitor dashboards in Metabase
Azure Monitor is Microsoft Azure's monitoring platform for metrics, logs, application performance, and alerting across Azure resources and applications. Metabase is where you turn those operational signals into shared, trustworthy dashboards. This guide covers two complementary paths: a lightweight MCP + CLI route that pulls live data with the Azure MCP Server and loads a CSV into Metabase with the Metabase CLI, and a durable pipeline route that syncs Azure Monitor rollups into a database so you can build dashboards anyone can read.
How do you connect Azure Monitor to Metabase?
Most teams combine both routes: use MCP and CLI uploads for a fast first pass, then move recurring reliability reporting to a warehouse-backed model.
Live data in, quick analysis out
Pair the Azure MCP Server with the Metabase CLI. Use MCP for live lookups, write a scoped result to CSV, then load it into Metabase as a ready-to-query table and model.
- Quick lookups such as "show me alert volume and noise"
- Loading a Azure Monitor export into Metabase in seconds
- Spot-checks and one-off analyses without a warehouse
- Great for exploration, not governed reliability reporting
- Use read-only/scoped credentials wherever the MCP server supports them
- CSV uploads are snapshots — refresh or move to the pipeline for history
Durable dashboards with history
Sync Azure Monitor rollups and metadata into a database or warehouse with a connector, custom pipeline, or API, then point Metabase at it.
- Azure Monitor reliability dashboards leaders depend on
- Joining Azure Monitor data with deploys, issues, support, or cost data
- Long-run trends for alert volume and noise and application availability and latency
- You own the refresh schedule and the rollup grain
- Sync aggregates and entities — not the raw event firehose
- Metric definitions must be consistent across services and teams
What can you analyze from Azure Monitor data in Metabase?
- Alert volume and noise — built from Log Analytics query rollups and the related alerts, Application Insights availability results, resource metrics data your sync exposes.
- Application availability and latency — built from Log Analytics query rollups and the related alerts, Application Insights availability results, resource metrics data your sync exposes.
- Resource utilization rollups — built from Log Analytics query rollups and the related alerts, Application Insights availability results, resource metrics data your sync exposes.
- Log volume and ingest cost — built from Log Analytics query rollups and the related alerts, Application Insights availability results, resource metrics data your sync exposes.
- Service health by workspace — built from Log Analytics query rollups and the related alerts, Application Insights availability results, resource metrics data your sync exposes.
Which Azure Monitor dashboards should you build in Metabase?
Service health overview
The shared reliability view to build first.
- Availability by service (table)
- Error rate by service by week (line)
- Latency p95 by service (line)
- SLO compliance by service (bar)
Alert volume and noise
Whether monitors earn their pages.
- Alerts fired per week by monitor (stacked bar)
- Alert-to-incident conversion (number + trend)
- Noisiest monitors (table)
- Muted or silenced alerts (table)
Error and log trends
Where exceptions and log anomalies cluster.
- Error events by service by week (line)
- Log volume by service (bar)
- Top error signatures (table)
- New signatures this week (table)
SLO and error budget
Reliability against explicit targets.
- Error budget remaining by service (bar)
- Budget burn rate, trailing 28 days (line)
- SLO breaches this quarter (table)
- Compliance by service tier (bar)
How do you use the Azure MCP Server with the Metabase CLI?
Pair the Azure MCP Server with the Metabase CLI for fast, hands-on analysis. MCP is useful for scoped lookups and summarized exports; the Metabase CLI's upload command loads CSV data into Metabase and creates a ready-to-query table and model.
Example workflow
- Ask the MCP server for a summarized slice of Log Analytics query rollups for the services you care about.
- Export the result as CSV, keeping stable IDs, services, environments, severities, and timestamps.
- Run
mb upload csvto load it into Metabase as a table and model, then build questions and dashboards on top.
Be honest about the limits
- MCP lookups are excellent for exploration, not scheduled reporting.
- A CSV upload is a snapshot; refresh it with
mb upload replaceor move to the pipeline for real history. - Periodic rollups (hourly or daily) are required for availability and error-rate trends.
mb upload csvneeds an uploads database configured under Admin → Settings → Uploads.
How do you set up Azure Monitor MCP and the Metabase CLI?
Azure MCP Serverofficial
- Transport
- Local server (npx) over stdio
- Auth
- Microsoft Entra ID (az login credential chain)
- Best for
- Live scoped lookup and export
Metabase CLIofficial
- Install
npm install -g @metabase/cli- Auth
mb auth login- Load data
mb upload csv --file data.csv- Requires
- An uploads database (Admin → Settings → Uploads)
{
"mcpServers": {
"azure": {
"command": "npx",
"args": ["-y", "@azure/mcp@latest", "server", "start"]
}
}
}Sign in first with az login — auth flows through Microsoft Entra ID. The Azure Monitor tools run KQL against Log Analytics workspaces; use an account scoped to read-only roles for analysis.
# Install the Metabase CLI
npm install -g @metabase/cli
# Log in (opens your browser; requires Metabase v62+)
mb auth login --url https://your-metabase.example.com
# Load a Log-Analytics-query-rollups export — creates a table AND a model
mb upload csv --file azure-monitor-Log-Analytics-query-rollups.csv --collection root
# Refresh that same table later from a new export
mb upload replace <table-id> --file azure-monitor-Log-Analytics-query-rollups.csvCan you generate a Azure Monitor dashboard with AI?
Yes. Use the prompt below with any assistant that can run the Azure MCP Server and the Metabase CLI. It works end to end: if Azure Monitor tables already exist in Metabase it analyzes those; otherwise it pulls scoped, summarized data over MCP, loads it with mb upload csv, then builds the dashboard and caveats any metric that needs missing history.
Create a polished Metabase dashboard for Azure Monitor observability analytics.
Work end to end: get the data into Metabase if it isn't there yet, then build.
Goal: Help engineering and operations leaders understand service availability, error rates, alert quality, and SLO compliance from Azure Monitor data.
Step 1 — Find or load the data:
- First, check what already exists in Metabase (search for azure-monitor tables and
models). If durable Azure Monitor data is already present — synced from a warehouse
or uploaded earlier — use it and skip to Step 2.
- If nothing is there, pull a scoped, summarized export with the Azure MCP Server:
Log Analytics query rollups, plus alerts, Application Insights availability results, resource metrics.
Prefer aggregated or rollup views over raw events. Write each result to a CSV,
then load it with the Metabase CLI — run "mb upload csv --file <export>.csv" so
each upload creates a table and a ready-to-query model. Use "mb upload replace
<table-id> --file <export>.csv" to refresh an existing table instead of creating
duplicates.
Step 2 — Inspect before querying:
Do not assume exact table or column names. Inspect available fields, services,
environments, timestamps, and whether rollups or history exist before creating
duration or trend cards.
Important:
- Build on whatever data is present; don't claim Metabase connects natively to
Azure Monitor — it reads a database or CLI-uploaded tables.
- Never try to load the raw event firehose into Metabase; use rollups, entity
tables, and incident- or group-grain data.
- Only compute durations (MTTA, MTTR, time-to-resolve) when the required
timestamps exist.
- Exclude test, staging, or muted objects from headline reliability cards, and
segment by environment where the field exists.
- A single CSV is a point-in-time snapshot: only build trend cards if there is a
usable date column or multiple periods have been uploaded.
Dashboard title: Azure Monitor Observability Overview
Sections:
1. Executive summary: Availability last 30 days; Error rate; Alerts fired;
SLO compliance; Services below target.
2. Service health: Availability and error rate by service by week.
3. Alerts: Alert volume by monitor; conversion to incidents; noisy monitors.
4. SLOs: Error budget remaining; burn rate; breaches by service.
5. Trends: Latency percentiles and traffic by service where synced.
Filters: Date range, Service, Environment, Severity, Team, Status.
Output: Build the dashboard if you have permission; otherwise provide the exact
questions, SQL, model definitions, and layout. Include caveats for any metric
that cannot be calculated from the available data.How do you sync Azure Monitor data into a database or warehouse?
For dashboards that need history and reliability, land Azure Monitor rollups and metadata in a database first, then connect Metabase to that database.
Connector options
- Managed ETL — use a connector when one covers the objects you need.
- Custom pipeline — use the Log Analytics query CLI for control over rollup grain, fields, and refresh cadence.
- MCP + CSV — use this for quick exploration and one-off slices.
Use the native paths: Log Analytics data export streams tables to Azure Storage or Event Hubs continuously, and `az monitor log-analytics query` exports KQL results (table or TSV output) for scripted rollups your warehouse loads.
Notes
- Decide the rollup grain first (hourly or daily per service/environment) — it drives warehouse cost and every trend card.
- Land raw entity tables first, then build clean Metabase models on top.
- Normalize service, environment, metric, window-start, and aggregation fields.
How should you model Azure Monitor data in Metabase?
Core tables
| Table | Grain | Key columns |
|---|---|---|
service_health_rollups | one row per service per hour or day | service_name, environment, window_start, total_requests, successful_requests, p95_latency_ms |
azure_monitor_alerts | one row per fired alert | id, alert_rule, resource_id, service_name, severity, fired_at, resolved_at, became_incident |
azure_resource_rollups | one row per resource per metric per hour | resource_id, resource_type, metric_name, window_start, avg_value, max_value |
Modeling advice
- Build a clean
service_health_rollupsmodel with common columns across tools, so multi-source dashboards don't fork definitions. - Separate entity tables (services, monitors, policies) from time-series rollups and event-grain tables.
- Exclude test, staging, and muted objects from headline reliability metrics; keep environment as an explicit column.
- Use stable IDs for service, team, and incident joins; display names change.
Which Azure Monitor metrics should you track in Metabase?
| Metric | Definition | Notes |
|---|---|---|
| Service availability | Successful requests or minutes divided by total, per service. | Define success once (status < 500, or probe-based). |
| Error rate | Error events divided by total requests per window. | Use rollups; raw events don't belong in a warehouse. |
| Alert noise rate | Alerts that led nowhere divided by all alerts fired. | Review the noisiest monitors monthly. |
| SLO compliance | Actual reliability against the SLO target and error budget. | Burn rate matters more than a point-in-time number. |
What SQL powers Azure Monitor dashboards in Metabase?
These assume a cleaned analytical model in a warehouse (PostgreSQL dialect). Adjust table and column names to match your pipeline.
From success/total rollups per service.
SELECT
service_name,
date_trunc('week', window_start) AS week,
ROUND(
100.0 * SUM(successful_requests) / NULLIF(SUM(total_requests), 0), 3
) AS availability_pct
FROM service_health_rollups
WHERE environment = 'production'
GROUP BY 1, 2
ORDER BY 1, 2;Which monitors page for real problems.
SELECT
monitor_name,
COUNT(*) AS alerts_fired,
COUNT(*) FILTER (WHERE became_incident) AS incidents,
ROUND(
100.0 * COUNT(*) FILTER (WHERE became_incident)
/ NULLIF(COUNT(*), 0), 1
) AS conversion_rate
FROM alerts
WHERE fired_at >= CURRENT_DATE - INTERVAL '30 days'
GROUP BY monitor_name
ORDER BY alerts_fired DESC
LIMIT 20;Actual reliability vs. the published target, trailing 28 days.
SELECT
service_name,
slo_target,
ROUND(
100.0 * SUM(successful_requests) / NULLIF(SUM(total_requests), 0), 3
) AS actual,
ROUND(
100.0 * SUM(successful_requests) / NULLIF(SUM(total_requests), 0), 3
) - slo_target AS margin
FROM service_health_rollups
WHERE window_start >= CURRENT_DATE - INTERVAL '28 days'
GROUP BY service_name, slo_target
ORDER BY margin ASC;