How to summarize by Severity Level in Azure Application Insights Logs for each operation name

PavanKumar GVVS 0
Viewed 26

I have multiple azure functions in single azure function app resource where each function logs are stored with function name inoperation_Name column of application insights logs. For all azure functions names, I am logging messages with Warnings(severityLevel=2) and Errors(severityLevel=3).

Expected: I am trying to show all functions warnings, errors in a single pie chart and later to pin to dashboard. Piechart should give us visibility how many errors and warnings for each function have in a single azure function app resource.

Actual: Pie chart is displaying for all severity levels(combining) for each function name(operationname) for a single azure function app resource.

traces
| where severityLevel >1
| where cloud_RoleName == 'dev-test-functionapp' //Azure Function App Resource Name
| where operation_Name in ('Function1Name','Function2Name','Function3Name')
| summarize by operation_Name,severityLevel
| render piechart

enter image description here

kql azure-application-insights
2 Answers

If I understand correctly, this could work:

traces
| where severityLevel > 1
| extend severityLevel = case(severityLevel == 2, "Warning", severityLevel == 3, "Error", tostring(severityLevel))
| where cloud_RoleName == 'dev-test-functionapp'
| where operation_Name in ('Function1Name','Function2Name','Function3Name')
| summarize count() by s = strcat(severityLevel, "_", operation_Name)
| render piechart
Yoni L.0
(Not an answer)
Replying the OP as to my comment about the choice of visualization.

Pie chart is an overused visualization.
It is great for storytelling for some scenarios when you want to emphasize the dominance of one or two elements or the lack of such.
It is quite bad for anything else.
It makes it very difficult to observe the details when there are more than just few elements and it is also very difficult to see the ratio between those elements.

Here is another option of unstacked column

unstacked column

David דודו Markovitz0
Related