Why does the REST API of Application Insights not support to save searches/queries

%3CLINGO-SUB%20id%3D%22lingo-sub-1776233%22%20slang%3D%22en-US%22%3EWhy%20does%20the%20REST%20API%20of%20Application%20Insights%20not%20support%20to%20save%20searches%2Fqueries%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1776233%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20reason%20why%20the%20saving%20of%20searches%2Ffunctions%20is%20not%20supported%20via%20REST%20API%20in%20Application%20Insights%20(%3CA%20href%3D%22https%3A%2F%2Fdev.applicationinsights.io%2Fdocumentation%2Foverview)%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdev.applicationinsights.io%2Fdocumentation%2Foverview)%3C%2FA%3E.%3CBR%20%2F%3EThis%20is%20possible%20in%20Log%20Analytics%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%3C%2FA%3E)%20but%20not%20in%20Application%20Insights.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1776288%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20does%20the%20REST%20API%20of%20Application%20Insights%20not%20support%20to%20save%20searches%2Fqueries%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1776288%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F714516%22%20target%3D%22_blank%22%3E%40emileer%3C%2FA%3E%26nbsp%3BCould%20you%20provide%20some%20context%20into%20what%20you're%20looking%20to%20do%3F%26nbsp%3B%20You%20can%20easily%20run%20queries%20with%20the%20API%20for%20Application%20Insights.%26nbsp%3B%20If%20some%20detail%20could%20be%20provided%20on%20the%20scenario%20you're%20trying%20to%20address%20we%20can%20help%20you%20in%20creating%20a%20solution.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B--%20Ryan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1776327%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20does%20the%20REST%20API%20of%20Application%20Insights%20not%20support%20to%20save%20searches%2Fqueries%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1776327%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F319411%22%20target%3D%22_blank%22%3E%40CloudyRyan%3C%2FA%3E%26nbsp%3BWe%20are%20using%20a%20VSTS%20delivery%20pipeline%20to%20deploy%20queries%2Ffunctions%20across%20multiple%20subscriptions%20(currently%20only%20supported%20via%20API%20by%20Log%20Analytics).%20The%20saved%20queries%20are%20used%20by%20support%20engineers%20to%20quickly%20identify%20and%20visualize%20problems%20in%20the%20respective%20environment.%3CBR%20%2F%3EWe%20would%20like%20to%20have%20a%20similar%20approach%20for%20Application%20Insights.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1776472%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20does%20the%20REST%20API%20of%20Application%20Insights%20not%20support%20to%20save%20searches%2Fqueries%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1776472%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F714516%22%20target%3D%22_blank%22%3E%40emileer%3C%2FA%3E%26nbsp%3BGot%20it%20--%20this%20helps.%26nbsp%3B%20Assuming%20you're%20using%20Workbooks%20with%20queries%2C%20the%20best%20way%20to%20do%20this%20is%20not%20via%20REST%20but%20with%20an%20ARM%20template%20from%20my%20POV.%26nbsp%3B%20You%20can%20export%20an%20existing%20workbook%20using%20the%20process%20shown%20in%20my%20screen%20shot%20and%20use%2C%20as%20part%20of%20your%20devops%20process%2C%20an%20%22ARM%20deployment%22%20task%20or%20us%20PowerShell%20or%20the%20CLI%20to%20push%20this%20into%20the%20subscription%2Fenvironment%20with%20a%20new%20App%20Insights%20Workspace.%26nbsp%3B%20You%20would%20need%20the%20resource%20ID%20of%20the%20App%20Insights%20workspace%20as%20shown%20in%20my%20screenshot.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Is there a reason why the saving of searches/functions is not supported via REST API in Application Insights (https://dev.applicationinsights.io/documentation/overview).
This is possible in Log Analytics (https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches) but not in Application Insights.

6 Replies

@emileer Could you provide some context into what you're looking to do?  You can easily run queries with the API for Application Insights.  If some detail could be provided on the scenario you're trying to address we can help you in creating a solution.

 

       -- Ryan

@CloudyRyan We are using a VSTS delivery pipeline to deploy queries/functions across multiple subscriptions (currently only supported via API by Log Analytics). The saved queries are used by support engineers to quickly identify and visualize problems in the respective environment.
We would like to have a similar approach for Application Insights. 

 

@emileer Got it -- this helps.  Assuming you're using Workbooks with queries, the best way to do this is not via REST but with an ARM template from my POV.  You can export an existing workbook using the process shown in my screen shot and use, as part of your devops process, an "ARM deployment" task or us PowerShell or the CLI to push this into the subscription/environment with a new App Insights Workspace.  You would need the resource ID of the App Insights workspace as shown in my screenshot.

@CloudyRyan - thanks ! Your solution will definitely work with workbooks.

There are however some scenarios that cannot use the approach mentioned above.

Here is an example:

- we analyze the application logs and create patterns for error entries (like: startswith("Exception123"), etc.)

- all these patterns are stored in a configuration file (whitelisted_error_patterns.json).
- at deployment time, we create (on the fly) a query that filters out all known error patterns and create an alert if the number of entries is > 0

- if the alert triggers, the service guys just have to click on the link and see in the portal all log entries that are not matched.
With this approach we achieve a total control of the log entries produced by our application.

If it helps, I can give you a short demo on how we us the whole processing chain.

@emileer What about creating the alert based on the Azure monitor query on the fly? Saved Searches (Azure Log Analytics) | Microsoft Docs  (App Insights is under the umbrella of Azure monitor).

@CloudyRyan it is much easier to handle if the alert only references a function and the logic is stored in the function (compared having the logic in the alert).

We do have a pipeline to deploy alerts, and the task is always performed after deploying the queries/functions.

It is also much easier to refine the queries (add new patterns) if they can be accessed directly from the portal.

In AppInsights you can save queries from the portal, but not programmatically via an exposed API (which is strange since internally the API must exist).