Question 108172 in Azure Question posted in
The official documentation to get you started can be found here.

Azure Application Insights | KQL | Get exception details

We are using Azure application Insights for error logging. I am new to KQL and trying to fetch custom properties from inbuilt "customDimensions" column in the following format,

Data in "customDimensions" column

{
  "File Name":"Sample File 1",
  "Correlation ID":"e33a8d45-0566-4bf2-94f8-54a6fec29bff",
  "Error List":"[
      {
        "Function Name":"Sample Function 1",
        "Code":"#231256#"
      },
      {
        "Function Name":"Sample-Function-2",
        "Code":"#231258#"
      },
   ]"
}

Expected Output

File Name Correlation ID Function Name Code
Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample Function 1 #231256#
Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample-Function-2 #231258#

How can I achieve the above output using KQL?

Thank You.

Update: Adding a sample datatable

datatable(ErrorDetails:dynamic)
[
    dynamic({
        "File Name":"Sample File 1",
        "Correlation ID":"e33a8d45-0566-4bf2-94f8-54a6fec29bff",
        "Error List": [{
                "Function Name":"Sample Function 1",
                "Code":"#231256#"
            },
            {
                "Function Name":"Sample-Function-2",
                "Code":"#231258#"
            }
        ]
    })
]
Tags:

2

Answers


  1. 0

    How can I achieve the above output using KQL?

    • Beow is the sample command which can be used to get the correlation id and function names in column.
    customEvents
 | extend Org = tostring(customDimensions.correlationID)
    • Refer this document which has related discussion.
    Login or Signup to reply.
  2. 0

    mv-expand operator

    datatable(ErrorDetails:dynamic)
[
    dynamic({
        "File Name":"Sample File 1",
        "Correlation ID":"e33a8d45-0566-4bf2-94f8-54a6fec29bff",
        "Error List": [{
                "Function Name":"Sample Function 1",
                "Code":"#231256#"
            },
            {
                "Function Name":"Sample-Function-2",
                "Code":"#231258#"
            }
        ]
    })
]
| mv-expand EL = ErrorDetails.["Error List"]
| project ["File Name"] = ErrorDetails["File Name"], ["Correlation ID"] = ErrorDetails["Correlation ID"], ["Function Name"] = EL["Function Name"], ["Code"] = EL["Code"]
    File Name Correlation ID Function Name Code
    Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample Function 1 #231256#
    Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample-Function-2 #231258#

    Fiddle

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search