CODEWITHSUNDEEP
azure-application-insights
heymega
heymega

Reputation: 9411

Application Insights - Querying Collections

I'm using Serilog to trace data to Application Insights.

In the custom properties, serilog logs a collection of faults as custom data like this...

faults.Count 2
faults.0 "SomeFault" 
faults.1 "AnotherFault"

How can I query these properties using Application Insights Analytics query language?

I want to report on any responses which contain "AnotherFault" without knowing the index.

Upvotes: 0

Views: 1839

Answers (1)

Dmitry Matveev
Dmitry Matveev

Reputation: 2679

It can be something as simple as:

search in (CustomEvents) "AnotherFault"

Alternatively, you can limit search to only custom dimensions:

CustomEvents
| where timestamp > ago(24h)
| where tostring(customDimensions) contains "AnotherFault"

Both will have its performance implications on large data sets due to string containment comparisons, so knowing either index or name or the property will definitely help here.

Another way is to perform | mvexpand and unfold each of the custom dimensions into its own row:

CustomEvents
| where timstamp > ago(24h)
| project customDimensions, usefulField1, usefulField2,....
| mvexpand bagexpansion=array customDimensions
| where customDimensions[1] == "AnotherFault"

By converting it to array, you can access the value of the custom dimension by generic [1] rather than by knowing its name, so you can do a full comparison to "AnotherFault" without using "faults.#" syntax. The trick is to reduce the amount of the fields you'd like to see before you do mvexpand to reduce memory multiplication.

Upvotes: 1

Related Questions