Azure Monitor vs Application Insights vs Log Analytics: one service, not three
Three names that sound like rival products trip up nearly everyone learning Azure observability. They are not competitors — they are one service and two of its parts, and once you see how the data flows, the confusion evaporates.
Open the monitoring corner of Azure and you meet three names in the first five minutes: Azure Monitor, Log Analytics, Application Insights. Newcomers assume they must choose between them, or that one replaces another. Neither is true. They are layers of a single observability story, and the fastest way to stop being confused is to learn what each layer is and how telemetry moves between them.
Azure Monitor: the umbrella
Start at the top. Microsoft defines it as "Microsoft's unified observability service for collecting, analyzing, and acting on telemetry from cloud and hybrid environments." It brings together metrics, logs, traces, and events into one experience. Azure Monitor is not a tool you open so much as the whole system — the thing that ingests your telemetry, stores it, and hangs the analysis tools, dashboards, and alerts off it. Log Analytics and Application Insights live inside Azure Monitor, not beside it.
Log Analytics: where logs live and get queried
Telemetry has to land somewhere. Azure Monitor's data platform uses Log Analytics workspaces to "collect log and trace data, which can be analyzed with Kusto Query Language (KQL)." So Log Analytics is two things at once: the store (the workspace your logs flow into) and the tool (the query experience where you write KQL against them). When you write a query to find what spiked at 3am, you are in Log Analytics, querying a workspace. It is the answer to "where did all this data go, and how do I ask it questions?"
Metrics and logs take different paths. Log Analytics workspaces hold logs and traces (queried with KQL); Azure Monitor workspaces hold Prometheus and OpenTelemetry metrics (queried with PromQL). Similar names, separate resources, different query languages. If you are querying logs, you want a Log Analytics workspace.
Application Insights: eyes on your application
The third name is the most specific. Application Insights is "an application performance monitoring (APM) feature of Azure Monitor" — the part that watches a live application from the inside. Point it at your web app and it tracks requests, dependencies, exceptions, and availability, and gives you an application map, live metrics, and failure and performance views. Crucially, its telemetry lands in a Log Analytics workspace, so the same KQL you use for platform logs works on your application data too. Log Analytics is the general log store and query tool; Application Insights is the app-focused lens that feeds it and adds application-shaped dashboards on top.
Azure Monitor is the building. Log Analytics is the filing room you query. Application Insights is the camera watching your app — and it files its footage in the same room.
| Name | What it is | You use it to… |
|---|---|---|
| Azure Monitor | The whole observability service | Collect, analyze, alert on all telemetry |
| Log Analytics | The log/trace store + KQL query tool | Ask your logs questions |
| Application Insights | The APM feature for apps | Watch requests, failures, and performance in a live app |
How the pieces fit
Read it as one sentence: Azure Monitor is the observability service; your resources and apps send it telemetry; logs and traces land in a Log Analytics workspace where you query them with KQL; and Application Insights is the feature that instruments an application, feeding its data into that same store while adding app-specific views on top. Nobody chooses "Log Analytics instead of Azure Monitor" — that is like choosing the filing cabinet instead of the office. You turn on Azure Monitor, you instrument your app with Application Insights, and you query all of it in Log Analytics. Say that back in an interview and you have shown you understand the platform, not just three logos.