Question 105712 in Azure Question posted in
The official documentation to get you started can be found here.

Azure log analytics severity level as string

Currently in azure application insights we see under severityLevel the number of ther severity level and not the text like information, error,… Is it possible to show the severityLevel as a string.

enter image description here

"Serilog": {
"Using": [
    "Serilog.Sinks.ApplicationInsights"
],
"MinimumLevel": {
    "Default": "Debug",
    "Override": {
        "Microsoft": "Information"
    }
},
"WriteTo": [
    {
        "Name": "ApplicationInsights",
        "Args": {
            "restrictedToMinimumLevel": "Information",
            "telemetryConverter": "Serilog.Sinks.ApplicationInsights.Sinks.ApplicationInsights.TelemetryConverters.TraceTelemetryConverter, Serilog.Sinks.ApplicationInsights",
            "instrumentationKey": "key"
        }
    }
],
"Enrich": [
    "FromLogContext"
],
"Properties": {
    "Application": "Sample"
}
}
Tags:

3

Answers


  1. 0

    The severity level is an enum, see the docs:

    Critical 4
    Critical severity level.

    Error 3
    Error severity level.

    Information 1
    Information severity level.

    Verbose 0
    Verbose severity level.

    Warning 2
    Warning severity level.

    We can use this to create a kusto query:

    let severities = datatable(severityLevel:int, severity:string)
[
   0, "Verbose",
   1, "Information",
   2, "Warning",
   3, "Error",
   4, "Critical",
];
traces
| join severities on severityLevel
| project timestamp, message, severity
    Login or Signup to reply.
  2. 0

    Ad hoc function, using let statement

    // Sample generation. Not part of the solution
let traces = materialize(range i from 1 to 10 step 1 | project severityLevel = toint(rand(5)), Timestamp = ago(rand()*1d));
// Solution starts here
let getSeverityDescription = (severityLevel:int)
{
    dynamic(["Verbose", "Information", "Warning", "Error", "Critical"])[severityLevel]
};
traces
| extend SeverityDescription = getSeverityDescription(severityLevel)
    severityLevel Timestamp SeverityDescription
    3 2022-06-29T11:56:30.3936027Z Error
    4 2022-06-29T15:08:45.0941469Z Critical
    4 2022-06-30T03:02:29.1658275Z Critical
    1 2022-06-30T03:29:22.4724933Z Information
    0 2022-06-30T04:01:15.7748102Z Verbose
    0 2022-06-30T04:37:39.740977Z Verbose
    2 2022-06-30T05:13:04.734582Z Warning
    2 2022-06-30T07:32:01.9569582Z Warning
    2 2022-06-30T07:41:46.3364296Z Warning
    1 2022-06-30T09:42:22.5852665Z Information

    Fiddle

    Login or Signup to reply.
  3. 0

    Keep it simple.

    traces
| extend SeverityLevel = case(severityLevel == 1, "Information",severityLevel == 2, "Warning",severityLevel == 3, "Error", tostring(severityLevel)), FromDate=ago(30d) 
| where (timestamp >= FromDate)
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search