How to Query Across Log Analytics and Application Insights in Azure Monitor

user_5139495 0
Viewed 2245

This answer summarizes that App Insights (AI) and Log Analytics (LA) are being merged into one service. It also provides a suggestion that new resources in AI can point at LA, so that all your code is in one place.

My question is how can I query across LA and AI resources, given that both exist, and you don't have the time or permissions to change the AI to point at LA.

Using Azure Workbooks I realised I can query from multiple resources inside LA or AI, but I don't seem to be able to query across LA and AI in one cell (nor save results between cells.)

At present the only ways I can think to solve this are to query through the API or joining in a PBI report, but both of these are massive overhead to complete exploratory querying. Is there an easier way, ideally whilst staying inside Kusto queries?

azure-log-analytics azure-data-explorer azure-application-insights azure
1 Answers

Azure Monitor is your one-stop shop for querying across cross-resources.

Previously with Azure Monitor, you could only analyze data from within the current workspace, and it limited your ability to query across multiple workspaces defined in your subscription. Additionally, you could only search telemetry items collected from your web-based application with Application Insights directly in Application Insights or from Visual Studio. This also made it a challenge to natively analyze operational and application data together.

Now you can query not only across multiple Log Analytics workspaces, but also data from a specific Application Insights app in the same resource group, another resource group, or another subscription. This provides you with a system-wide view of your data. You can only perform these types of queries in Log Analytics.

To reference another workspace in your query, use the workspace identifier, and for an app from Application Insights, use the app identifier.

For example, you can query multiple resources from any of your resource instances, these can be workspaces and apps combined like below.

// crossResource function that scopes my Application Insights resources
union withsource= SourceApp
app('Contoso-app1').requests, 
app('Contoso-app2').requests,
app('Contoso-app3').requests,
app('Contoso-app4').requests,
app('Contoso-app5').requests

Or like,

union Update, workspace("contosoretail-it").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification

Or like,

applicationsScoping 
| where timestamp > ago(12h)
| where success == 'False'
| parse SourceApp with * '(' applicationName ')' * 
| summarize count() by applicationName, bin(timestamp, 1h) 
| render timechart

For details, refer this.

user_137919530
Related