--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Advanced query support for AWS and Azure # Advanced query support for AWS and Azure {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Advanced query support for AWS and Azure This feature enables ServiceNow customers to create advanced, JSON-formatted queries for Service Observability dashboard charts using vendor-specific query languages from AWS and Azure. It allows direct integration with AWS CloudWatch and Azure dashboards by copying and adapting queries into Service Observability's Advanced query field, facilitating detailed monitoring and analysis of cloud resources. Show full answer Show less ## Advanced Queries for AWS AWS data is accessed via the **GetMetricData API**. Customers can either: * Use a direct JSON request to the API, specifying metrics, dimensions, time periods, and expressions. * Copy JSON objects from existing AWS CloudWatch dashboard widgets, which represent metric charts. Template variables such as `${ENTITIESELB}` for ELB instances or `${START}` and `${END}` for time ranges allow dynamic querying based on the selected service context, enabling time series displays for multiple entities without modifying the query for each instance. Note that JSON copied from AWS dashboards does not include explicit time fields, as these are automatically controlled by the Service Observability UI time picker. Common template variables for AWS include various entity identifiers (e.g., `ENTITIESHOST`, `ENTITIESLAMBDA`) used in Dimensions values and `START` and `END` for time boundaries. ## Advanced Queries for Azure For Azure, advanced queries involve exporting a dashboard from the Azure UI and extracting the JSON definition of a chart from the exported file. This JSON, containing metric names and resource metadata (with resource IDs or template variables), is pasted into the Advanced query field in Service Observability. The minimal required JSON structure must include metrics with `name` and `resourceMetadata.id` fields to correctly identify the Azure resource to query. ## Key Benefits for ServiceNow Customers * Leverage native, vendor-specific query languages to create precise and flexible monitoring charts. * Reuse existing AWS and Azure dashboard configurations for faster setup and consistency. * Use template variables to dynamically target resources and time intervals based on service context. * Integrate cloud monitoring data seamlessly into ServiceNow's Service Observability dashboards for enhanced visibility. Understand how to create advanced queries for Service Observability dashboard charts. Advanced queries in Service Observability support most vendor-specific query languages. Simply copy a query from the observability chart and paste it into the Advanced query field in Service Observability. However, queries to AWS and Azure must be JSON-formatted and follow the guidelines outlined in this topic. Note: As of version 1.10, you can import charts directly from AWS and Azure. See [Edit data charts on Service Observability dashboard templates](https://www.servicenow.com/docs/N~1AJ3QLNx6lxvoGULyPEQ "Edit Service Observability dashboard templates to view different observability metrics on the Overview or Observability tabs' charts. Metrics are scoped to the selected service.") for more information. ## AWS advanced queries {#advanced-query-support__section_ovl_dn3_zfc} Data from AWS is accessed using the `GetMetricData` API. Queries can be either a direct request in JSON format to that API or they can be in the form of a `DashboardBody` metric widget. For example, you can use the widget representation for a chart that exists on an AWS CloudWatch dashboard. ## Direct GetMetricData request {#advanced-query-support__example_igf_gp3_zfc} The following example shows a `GetMetricData` JSON query for a chart that displays the average CPU Utilization for an ELB instance. { "StartTime": 1637061900, // can be replaced with "${START}" "EndTime": 1637074500, // can be replaced with "${END}" "MetricDataQueries": [ { "Expression": "SELECT AVG(CPUUtilization) FROM SCHEMA(\"AWS/EC2\", InstanceId)", "Id": "q1", "Period": 300, "Label": "Cluster CpuUtilization" }, { "Id": "m1", "Label": "Unhealthy Behind Load Balancer", "MetricStat": { "Metric": { "Namespace": "AWS/ApplicationELB", "MetricName": "UnHealthyHostCount", "Dimensions": [ { "Name": "LoadBalancer", "Value": "app/EC2Co-EcsEl-EXAMPLE69Q/fdd2210e799e4376" // can be replaced with "${ENTITIES}" or "${ENTITIES_ELB}" } ] }, "Period": 300, "Stat": "Average" } } ] } ## Copied source for a single object in an AWS CloudWatch dashboard {#advanced-query-support__id_vhs_qq3_zfc} This example shows the JSON copied directly from a single object in the widgets list of the Source view for a CloudWatch dashboard. { "type": "metric", "x": 9, "y": 0, "width": 15, "height": 5, "properties": { "view": "timeseries", "metrics": [ [ "AWS/ApplicationELB", "RequestCountPerTarget", "TargetGroup", "targetgroup/api-tg/1e3dc9z72fe21ca2", "AvailabilityZone", "us-west-1a" ], ["...", "targetgroup/api-tg-cs/82a1db5f950073e1", ".", "." ] ], "region": "us-west-1" } } Both types of queries can use template variables to represent a set of entities or the start and end time selected in the UI. For example, instead of querying for a single ELB instance, you can replace the `Value` field for the `LoadBalancer` dimension with `${ENTITY_ELB}`. The query is run against each ELB instance associated with the selected service in the Service Observability UI. The chart displays a time series for each one. Note: JSON objects copied from the source of a CloudWatch dashboard don't include explicit time fields. The values from the time picker in the Service Observability UI are used automatically. {#advanced-query-support__table_tgs_c53_zfc__entry__2} | AWS field | Template variable | |-|-| | `Dimensions[n].Value` | * `ENTITIES` * `ENTITIES_HOST` * `ENTITIES_LAMBDA` * `ENTITIES_API_GATEWAY_HTTP` * `ENTITIES_API_GATEWAY_REST` * `ENTITIES_ELB` * `ENTITIES_RDS` {#advanced-query-support__ul_e1z_g53_zfc} The `Dimensions[n].Value` field must be a resource identifier key. | | `StartTime` | `START` | | `EndTime` | `END` | [Table 1. Template variables] {#advanced-query-support__table_tgs_c53_zfc} ## Azure advanced queries {#advanced-query-support__section_d3x_2n3_zfc} You run an advanced query for an Azure-based chart by copying the source from the Azure UI and pasting it in the Advanced query field. To copy the source: 1. In the Azure UI, export and download the dashboard. 2. Copy the JSON for a single chart. Charts are located at `properties.lenses[i].parts[j].metadata.settings.content.options.chart`. 3. Paste the JSON into the query field. The JSON must include at least the following: ``` { "metrics": [ "name": string, "resourceMetadata": { "id": string } ] } ``` The `id` field must be either an Azure resource ID or a [template variable](https://www.servicenow.com/docs/vUGhycjjZopagq4wvR_lfg "Understand the template variables that you can use in your queries when editing Service Observability dashboards and charts."). {#advanced-query-support__ol_msx_xw3_zfc}