Querying ApplicationInsights

%3CLINGO-SUB%20id%3D%22lingo-sub-214538%22%20slang%3D%22en-US%22%3EQuerying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214538%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20should%20we%20be%20querying%20ApplicationInsights%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20don't%20get%20Intellisense%20this%20way.%26nbsp%3B%3C%2FP%3E%3CPRE%3Eapp(%22Sitecore%20Production%22).traces%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20Schema%20isn't%20consistent%20this%20way.%26nbsp%3B%3C%2FP%3E%3CPRE%3EApplicationInsights%3CBR%20%2F%3E%7C%20traces%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20this%20just%20doesn't%20work%20at%20all%20unless%20I%20am%20in%20the%20Application%20Insights%20Analytics%20portal%20(%3CA%20href%3D%22https%3A%2F%2Fanalytics.applicationinsights.io%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fanalytics.applicationinsights.io%3C%2FA%3E)%3C%2FP%3E%3CPRE%3Etraces%26nbsp%3B%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDevin%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-214538%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Insights%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-306894%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-306894%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Evgeny%2C%3C%2FP%3E%3CP%3EAre%20there%20any%20news%20regarding%26nbsp%3B%3CSPAN%3Ecross-Application%20Insights-Log%20Analytics%20alerts%20support%3F%26nbsp%3BAs%20I%20can%20see%20it%20does%20not%20work%20yet.%20Still%20no%20ETA%20for%20this%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-217571%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-217571%22%20slang%3D%22en-US%22%3E%3CP%3EDaniel%2C%20you're%20absolutely%20correct%20in%20the%20query%20being%20fine.%20Unfortunately%2C%20right%20now%20alerts%20do%20not%20yet%20support%20cross-Application%20Insights-Log%20Analytics%20alerts.%20It%20is%20something%20that%20is%20on%20their%20backlog%2C%20but%20without%20firm%20ETAs%20yet.%20I've%20let%20them%20know%20of%20this%20discussion%2C%20and%20they'll%20reply%20if%20there's%20any%20additional%20information%20available.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20specific%20case%20however%2C%20the%20good%20news%20is%20that%20since%20you're%20targeting%20a%20single%20app%2C%20Application%20Insights%20also%20supports%20log-based%20alerts!%20Instead%20of%20creating%20this%20alert%20targeted%20at%20your%20Log%20Analytics%20resource%2C%20in%20the%20Azure%20portal%20open%20the%20%22%3CSPAN%3ESitecore%20Production%3C%2FSPAN%3E%22%20Application%20Insights%20resource%2C%20select%20%22Alerts%22%20from%20the%20left-hand%20navigation%20menu%20on%20the%20AI%20blade%2C%20and%20under%20target%2C%20select%20%22custom%20log%20search%22.%20Your%20query%20would%20then%20look%20identical%2C%20minus%20using%20%22dependencies%22%20instead%20of%20%22app(...).dependencies%22%20for%20your%20first%20line.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-216708%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216708%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20query%20is%20working%20fine%20in%20log%20analytics%2C%20and%20the%20data%20is%20definitely%20there%2C%20but%20it%20is%20still%20throwing%20in%20error%2C%20that%20states%3A%20Query%20syntax%20error.%3CBR%20%2F%3E%3CBR%20%2F%3Eapp(%22Sitecore%20Production%22).dependencies%3CBR%20%2F%3E%7Cwhere%3CBR%20%2F%3Etarget%20!contains%20%22brightcove%22%3CBR%20%2F%3Eand%20target%20!contains%20%22sitecore1.maxmind.com%22%3CBR%20%2F%3Eand%20target%20!contains%20%22lkqd%22%3CBR%20%2F%3E%7Csummarize%3CBR%20%2F%3EFailure_rate%3D%20((sum(iif(success%3D%3D%22True%22%2C%200%2C%201%20)%20)%2B0.00000)%2F%20count())%20*%20100%2C%3CBR%20%2F%3Efailures%3Dsum(iif(success%3D%3D%22True%22%2C%200%2C%201%20)%20)%2C%3CBR%20%2F%3Etotal%3Dcount()%3CBR%20%2F%3Eby%20target%2C%20bin(timestamp%2C1h)%3CBR%20%2F%3E%7Cwhere%20Failure_rate%20%26gt%3B%2050%3CBR%20%2F%3E%3CBR%20%2F%3EThis%20is%20the%20query%20I%20am%20trying%20to%20run.%3CBR%20%2F%3E%3CBR%20%2F%3ELooking%20at%20the%20first%20comment%2C%20It%20looks%20like%20we%20were%20relying%20on%20method%20%232%2C%20but%20seems%20to%20be%20no%20longer%20viable.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-216680%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216680%22%20slang%3D%22en-US%22%3E%3CP%3ELooks%20like%20the%20data%20is%20not%20been%20captured%20in%20the%20LA%20from%20the%20VM%2C%20please%20check%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20Check%20if%20the%20data%20is%20been%20captured%20in%20LA%2C%20try%20with%20the%20basic%20queries%20to%20see%20the%20data.%3C%2FP%3E%3CP%3E2.Agent%20is%20properly%20installed%20%3F%20if%20not%20try%20to%20reinstall%20it%20in%20the%20VM.%3C%2FP%3E%3CP%3E3.%20Check%20the%20Internet%20connectivity%20in%20the%20VM%20to%20communicate%20also%20port%20443%20should%20be%20opened%20as%20by%20default%20the%20internet%20access%20is%20restricted.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20should%20give%20help%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-216506%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216506%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EHow%20would%20I%20write%20the%20query%20if%20I%20wanted%20to%20use%20it%20for%20azure%20alerts%2C%20to%20query%20though%20dependencies%3F%20I'm%20currently%20trying%20option%20one%20listed%20above%2C%20but%20it%20is%20returning%20an%20error.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F37822i8F09D9492A45AB84%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image.png%22%20title%3D%22image.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215089%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215089%22%20slang%3D%22en-US%22%3E%3CP%3EDevin%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you're%20querying%20exclusively%20Application%20Insights%2C%20please%20use%20option%203%20(querying%20from%20within%20Application%20Insights).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you're%20querying%20a%20combination%20of%20Log%20Analytics%20and%20Application%20Insights%2C%20please%20use%20option%20%231%20from%20within%20either%20the%20AI%20or%20LA%20portals.%20IntelliSense%20support%20is%20something%20high%20on%20our%20backlog%2C%20together%20with%20a%20better%20unification%20between%20the%20two%20services.%20Expect%20to%20see%20features%20around%20this%20in%20the%20coming%20months.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOption%202%20should%20be%20considered%20outdated.%20I'd%20turn%20off%20the%20Application%20Insights%20connector%20to%20both%20avoid%20the%20schema%20confusion%2C%20as%20well%20as%20save%20yourself%20some%20costs%20from%20dual-ingesting%20the%20data.%20This%20feature%20was%20originally%20created%20as%20a%20stop-gap%20before%20we%20had%20cross-AI-and-LA%20queries%20available.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-214824%22%20slang%3D%22en-US%22%3ERe%3A%20Querying%20ApplicationInsights%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214824%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20can%20i%20know%20what%20are%20you%20trying%20to%20achieve%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

How should we be querying ApplicationInsights?

 

I don't get Intellisense this way. 

app("Sitecore Production").traces

 

The Schema isn't consistent this way. 

ApplicationInsights
| traces

 

And this just doesn't work at all unless I am in the Application Insights Analytics portal (https://analytics.applicationinsights.io)

traces 

 

Devin

7 Replies

Hi, can i know what are you trying to achieve ?

Devin,

 

If you're querying exclusively Application Insights, please use option 3 (querying from within Application Insights).

 

If you're querying a combination of Log Analytics and Application Insights, please use option #1 from within either the AI or LA portals. IntelliSense support is something high on our backlog, together with a better unification between the two services. Expect to see features around this in the coming months.

 

Option 2 should be considered outdated. I'd turn off the Application Insights connector to both avoid the schema confusion, as well as save yourself some costs from dual-ingesting the data. This feature was originally created as a stop-gap before we had cross-AI-and-LA queries available.

Hello, 

How would I write the query if I wanted to use it for azure alerts, to query though dependencies? I'm currently trying option one listed above, but it is returning an error.image.png

Looks like the data is not been captured in the LA from the VM, please check the following:

 

1. Check if the data is been captured in LA, try with the basic queries to see the data.

2.Agent is properly installed ? if not try to reinstall it in the VM.

3. Check the Internet connectivity in the VM to communicate also port 443 should be opened as by default the internet access is restricted.

 

Hope this should give help you.

The query is working fine in log analytics, and the data is definitely there, but it is still throwing in error, that states: Query syntax error.

app("Sitecore Production").dependencies
|where
target !contains "brightcove"
and target !contains "sitecore1.maxmind.com"
and target !contains "lkqd"
|summarize
Failure_rate= ((sum(iif(success=="True", 0, 1 ) )+0.00000)/ count()) * 100,
failures=sum(iif(success=="True", 0, 1 ) ),
total=count()
by target, bin(timestamp,1h)
|where Failure_rate > 50

This is the query I am trying to run.

Looking at the first comment, It looks like we were relying on method #2, but seems to be no longer viable.

Daniel, you're absolutely correct in the query being fine. Unfortunately, right now alerts do not yet support cross-Application Insights-Log Analytics alerts. It is something that is on their backlog, but without firm ETAs yet. I've let them know of this discussion, and they'll reply if there's any additional information available. 

 

In this specific case however, the good news is that since you're targeting a single app, Application Insights also supports log-based alerts! Instead of creating this alert targeted at your Log Analytics resource, in the Azure portal open the "Sitecore Production" Application Insights resource, select "Alerts" from the left-hand navigation menu on the AI blade, and under target, select "custom log search". Your query would then look identical, minus using "dependencies" instead of "app(...).dependencies" for your first line.

Hi Evgeny,

Are there any news regarding cross-Application Insights-Log Analytics alerts support? As I can see it does not work yet. Still no ETA for this?