Existing queries in Application Insights don't work in OMS

Copper Contributor

I'm trying out the Application Insights Connector in OMS and noticed that queries that worked in the Application Insights Analytics searches don't seem to work in OMS. These queries involve summarizing over custom fields of custom events.

 

What I think I'm seeing the problem is, is that the customDimensions field in Application Insights of for example,

{"firstname": "John", "lastname": "Doe"}

 gets converted in OMS to the CustomEventDimensions field but as:

"firstname": "John", "lastname": "Doe"

which is no longer a json object nor qualified json string, so functions like extractjson() and parsejson() don't work too.

 

Am I missing something and there's supposed to be a way for me to extract those fields for summarizing in OMS?

4 Replies

Hi,

I haven't used the connector myself, but indeed the data structure is not equivalent to that used in Application Insights. Summarizng the data should still be possible, using other operators. 

What exactly would you like to calculate?

Hi,
For example, let custom event be:

track_event('test_drive', {"brand": "foo", "make": "bar"})

Somthing I do in Application Insights is a query like such:

customEvents | where name == 'test_drive' | summarize by count() by tostring(customDimensions.brand)

where I do a count of a specific custom event summarized over a field I created for that event.

There are several ways, here are examples for parse and extract:

parse ('"firstname": "John", "lastname": "Doe"') 
with '"firstname": "' firstname '", "lastname": "' lastname '"'
| project firstname, lastname 

 

...| extend custom_value='"firstname": "John", "lastname": "Doe"'
| extend names = extractall('"firstname": "(.*)", "lastname": "(.*)"', custom_value)
| project custom_value, firstname=names[0][0], lastname=names[0][1]


over these you eventually summarize as you prefer.

Just to give you some history.  App Insights Connector was created when OMS didn't support json so we had to transform these.  In the near future, the need for connector will go away and you should be able to query data directly for e.g. app('foo').events | take 100.