Azure Log Analytics API — Query with row_number() Fails with E_LOW_MEMORY_CONDITION Error

Question

Azure Log Analytics API — Query with row_number() Fails with E_LOW_MEMORY_CONDITION Error

Atul Bansal (Trianz) 0

I am using the Azure Log Analytics REST API (https://api.loganalytics.io/v1/workspaces/{workspaceId}/query) to fetch logs in batches.

My KQL query looks like this:

Event
| where TimeGenerated > datetime('2025-07-12T15:47:10.492564300Z')
  and TimeGenerated <= datetime('2025-08-11T15:47:10.492564300Z')
| order by TimeGenerated asc
| serialize RowIndex = row_number()
| where RowIndex > 0
| take 499

When I run this query, I get the following error response from the API:

"error": {
    "code": "PartialError",
    "message": "There were some errors when processing your query.",
    "details": [
        {
            "code": "EngineError",
            "message": "Something went wrong processing your query on the server.",
            "innererror": {
                "code": "-2133196793",
                "message": "Partial query failure: Low memory condition (E_LOW_MEMORY_CONDITION). (message: bad allocation (E_LOW_MEMORY_CONDITION))",
                "severity": 2,
                "severityName": "Error"
            }
        }
    ]
}

Bharath Y P 80 Reputation points Microsoft External Staff Moderator

2025-08-12T17:44:21.3433333+00:00
Hello Atul Bansal (Trianz),

Welcome to Microsoft Q&A,

You're encountering a "Partial query failure: Low memory condition" in Azure Log Analytics because the query exceeded the processing capacity of the backend node. This typically results from one or more of the following:

Excessive number of rows

Large volume of data scanned

Complex operations, such as row_number() applied to a large dataset

The row_number() function assigns a unique sequential number to each row in the result set. When applied to large or unfiltered datasets, it can significantly increase memory consumption. If the server runs out of memory during execution, Azure Log Analytics returns an E_LOW_MEMORY_CONDITION error via the REST API.

Queries that involve multiple joins, lookups, aggregations, or functions like row_number() can consume substantial memory resources.

In your query, although you're using take 499 at the end, the row_number() function is evaluated before the take operation. This means the system processes all rows within the specified range prior to returning the final subset—leading to high memory usage.

To resolve this issue, consider the following best practices:

Avoid using serialize with row_number(), as it requires scanning the entire dataset before applying filters, which can lead to high memory usage.

Use indexed and sortable fields for pagination, such as TimeGenerated combined with a unique event identifier. Query smaller time windows or apply filters on key values to reduce dataset size and improve performance.

Like:

Event | where TimeGenerated > datetime('2025-07-12T15:47:10.492564300Z') and TimeGenerated <= datetime('2025-08-11T15:47:10.492564300Z') | order by TimeGenerated asc | take 499

Recommended Approach for Pagination in Azure Log Analytics:

Use time-based pagination by filtering on the TimeGenerated field to logs.

Fetch logs in small, contiguous time windows rather than relying on row_number() or serialize, which can be memory-intensive.

Keep each query lightweight by limiting the dataset size to avoid exceeding memory thresholds

This method enables efficient handling of large log datasets, minimizes the risk of memory-related errors, and aligns with best practices for scalable querying in Azure Log Analytics.

Also please refer the below thread below:

https://learn.microsoft.com/en-us/answers/questions/935952/e-low-memory-condition

Let me know if this was helpful.

Share via

Azure Log Analytics API — Query with row_number() Fails with E_LOW_MEMORY_CONDITION Error

Your answer