I'm trying to fetch logged data in Application Insight for a Function App. This app resides in turn in a Logic App. What I want to achieve is to correlate the Function App and Logic App in a query so that the output is as follows:
timestamp | message | runId
9/16/2022, 10:22:13.496 AM FA log 1 08585382903523634302640915722CU00
9/16/2022, 10:25:13.496 AM FA log 2 08585382902078946886579851044CU00
Basically, get the runId for the Logic App in which the FA outputs the above messages.
I've managed to do this by building this query:
traces
| where timestamp > ago(1h)
| where operation_Name has "FlowRunLastJob"
| where cloud_RoleName has "la-testing-send" // Logic App
| join
(
traces
| where cloud_RoleName has "la-testing-send-fa" // Function App
| where message has "FA log"
| project operation_Id, message, timestamp
)
on operation_Id
| extend runId = tostring(parse_json(tostring(parse_json(tostring(customDimensions.prop__properties)).resource)).runId)
| project timestamp = timestamp1, message = message1, runId
As you can see I've used operation_Id as the main identifier to correlate the telemetry. This has worked quite well as it has been a unique identifier for each Logic App run and its companion Function app... BUT, recently when I redeployed the logic app the Logic App operation_id stayed static with the same value.. hence the correlation doesn't work anymore. I'm not sure if it's a glitch or not. What I'm wondering is:
a) is operation_id the way to go to correlate LA and FA in this manner?
b) if not, what is the best way to achieve this type of correlation?
Big thanks for helping out. I appreciate it alot.
Cheers.