Azure application gateway accesslogs query - Timetaken

[Vinoth_Azure]

I have all my Application Gateway logs going to a Log Analytics workspace. I want to query this data to show any URIs with latency and period of the site responses from backend pools. Can someone point me in the right direction of how to query this?

Thanks 

Darwin Vinoth

[#2]

Hello, Darwin.

Here is an example of a query that gives you some statistics for the last 3 days:

AzureDiagnostics

| where Category == 'ApplicationGatewayAccessLog' and TimeGenerated > ago(3d)

| summarize RequestCount = count(), AvgTimeTaken = avg(timeTaken_d), percentiles(timeTaken_d, 50, 75, 95, 99) by backendPoolName_s, requestUri_s, httpMethod_s

| order by AvgTimeTaken desc

If you want to know which columns the AppGW access logs contain and then filter/summarize by other columns, run this query (it retuns a 10 logs sample):

AzureDiagnostics

| where Category == 'ApplicationGatewayAccessLog'

| take 10

If you want to know more about the Kusto query language, you can start here.

If you can't figure out how to write a query to answer a specific question you might have, please let me know.

[#3]

@hspinto 

Thanks for such a query. I would like to set my own set of queries. Is there any blog I can refer to get know about such query language.

Thanks

Darwin Vinoth  

[#4]

@Vinoth_Azure, there isn't a blog dedicated to the Kusto Query Language that I am aware of. However, you can also refer to this good article on how to get started with Log Analytics queries:

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-queries