统一多个 Azure Monitor Application Insights 资源Unify multiple Azure Monitor Application Insights resources

本文介绍如何在一个位置查询和查看所有 Application Insights 日志数据(即使这些数据位于不同 Azure 订阅),可作为弃用 Application Insights 连接器的替换方式。This article describes how to query and view all your Application Insights log data in one place, even when they are in different Azure subscriptions, as a replacement for the deprecation of the Application Insights Connector. 可以在单个查询中包含的 Application Insights 资源的数量限制为 100。The number of Application Insights resources that you can include in a single query is limited to 100.

在查询中列出多个 Application Insights 资源可能很繁琐且难以维护。Listing multiple Application Insights resources in a query can be cumbersome and difficult to maintain. 可以改为利用函数将查询逻辑从应用程序范围中分离出来。Instead, you can leverage function to separate the query logic from the applications scoping.

本示例演示了如何监视多个 Application Insights 资源,并按应用程序名称显示失败请求的计数。This example demonstrates how you can monitor multiple Application Insights resources and visualize the count of failed requests by application name.

使用 union 运算符和应用程序列表创建函数,然后在工作区中使用别名 applicationsScoping 将该查询保存为函数。Create a function using union operator with the list of applications, then save the query in your workspace as function with the alias applicationsScoping.

可以通过导航到工作区中的查询资源管理器,然后选择要编辑的函数并保存,或使用 SavedSearch PowerShell cmdlet 来随时修改列出的应用程序。You can modify the listed applications at any time in the portal by navigating to Query explorer in your workspace and selecting the function for editing and then saving, or using the SavedSearch PowerShell cmdlet.

Note

此方法不能用于日志警报,因为警报规则资源(包括工作区和应用程序)的访问验证在创建警报时执行。This method can't be used with log alerts because the access validation of the alert rule resources, including workspaces and applications, is performed at alert creation time. 不支持在创建警报后将新资源添加到该函数。Adding new resources to the function after the alert creation isn't supported. 如果更喜欢使用函数在日志警报中确定资源范围,则需要在门户中编辑警报规则或使用资源管理器模板来更新范围内的资源。If you prefer to use function for resource scoping in log alerts, you need to edit the alert rule in the portal or with a Resource Manager template to update the scoped resources. 或者,可以在日志警报查询中包含资源列表。Alternatively, you can include the list of resources in the log alert query.

withsource= SourceApp 命令可向结果添加用于指定发送日志的应用程序的列。The withsource= SourceApp command adds a column to the results that designates the application that sent the log. 本示例中的 parse 运算符为可选项,用于从 SourceApp 属性中提取应用程序名称。The parse operator is optional in this example and uses to extracts the application name from SourceApp property.

union withsource=SourceApp 
app('Contoso-app1').requests,  
app('Contoso-app2').requests, 
app('Contoso-app3').requests, 
app('Contoso-app4').requests, 
app('Contoso-app5').requests 
| parse SourceApp with * "('" applicationName "')" *  

现在便可以在跨资源查询中使用 applicationsScoping 函数:You are now ready to use applicationsScoping function in the cross-resource query:

applicationsScoping 
| where timestamp > ago(12h)
| where success == 'False'
| parse SourceApp with * '(' applicationName ')' * 
| summarize count() by applicationName, bin(timestamp, 1h) 
| render timechart

虽然是在工作区中执行查询,但该查询使用 Application Insights 架构,因为 applicationsScoping 函数会返回 Application Insights 数据结构。The query uses Application Insights schema, although the query is executed in the workspace since the applicationsScoping function returns the Application Insights data structure. 函数别名返回来自所有已定义应用程序的请求的并集。The function alias returns the union of the requests from all the defined applications. 然后,查询筛选失败的请求,并按应用程序显示趋势。The query then filters for failed requests and visualizes the trends by application.

跨查询结果示例

Note

新的 scheduledQueryRules API 支持日志警报中的跨资源查询Cross-resource query in log alerts is supported in the new scheduledQueryRules API. 默认情况下,Azure Monitor 使用旧版 Log Analytics 警报 API 从 Azure 门户创建新的日志警报规则。By default, Azure Monitor uses the legacy Log Analytics Alert API for creating new log alert rules from Azure portal. 是否可以创建跨资源查询日志警报规则,而无需使用适用于 scheduledQueryRules API 的 ARM 模板进行切换?You can create cross-resource query log alert rules without making the switch by using the ARM template for scheduledQueryRules API ? 但是,此警报规则可通过 scheduledQueryRules API 而不是 Azure 门户进行管理。but this alert rule is manageable though scheduledQueryRules API and not from Azure portal.

Application Insights 和 Log Analytics 工作区的架构差异Application Insights and Log Analytics workspace schema differences

下表显示了 Log Analytics 和 Application Insights 之间的架构差异。The following table shows the schema differences between Log Analytics and Application Insights.

Log Analytics 工作区属性Log Analytics workspace properties Application Insights 资源属性Application Insights resource properties
AnonUserIdAnonUserId user_iduser_id
ApplicationIdApplicationId appIdappId
ApplicationNameApplicationName appNameappName
ApplicationTypeVersionApplicationTypeVersion application_Versionapplication_Version
AvailabilityCountAvailabilityCount itemCountitemCount
AvailabilityDurationAvailabilityDuration durationduration
AvailabilityMessageAvailabilityMessage messagemessage
AvailabilityRunLocationAvailabilityRunLocation locationlocation
AvailabilityTestIdAvailabilityTestId idid
AvailabilityTestNameAvailabilityTestName namename
AvailabilityTimestampAvailabilityTimestamp timestamptimestamp
浏览者Browser client_browserclient_browser
城市City client_cityclient_city
ClientIPClientIP client_IPclient_IP
ComputerComputer cloud_RoleInstancecloud_RoleInstance
国家/地区Country client_CountryOrRegionclient_CountryOrRegion
CustomEventCountCustomEventCount itemCountitemCount
CustomEventDimensionsCustomEventDimensions customDimensionscustomDimensions
CustomEventNameCustomEventName namename
DeviceModelDeviceModel client_Modelclient_Model
DeviceTypeDeviceType client_typeclient_Type
ExceptionCountExceptionCount itemCountitemCount
ExceptionHandledAtExceptionHandledAt handledAthandledAt
ExceptionMessageExceptionMessage messagemessage
ExceptionTypeExceptionType typetype
OperationIDOperationID operation_idoperation_id
OperationNameOperationName operation_Nameoperation_Name
操作系统OS client_OSclient_OS
PageViewCountPageViewCount itemCountitemCount
PageViewDurationPageViewDuration durationduration
PageViewNamePageViewName namename
ParentOperationIDParentOperationID operation_Idoperation_Id
RequestCountRequestCount itemCountitemCount
RequestDurationRequestDuration durationduration
RequestIDRequestID idid
RequestNameRequestName namename
RequestSuccessRequestSuccess successsuccess
ResponseCodeResponseCode resultCoderesultCode
角色Role cloud_RoleNamecloud_RoleName
RoleInstanceRoleInstance cloud_RoleInstancecloud_RoleInstance
SessionIdSessionId session_Idsession_Id
SourceSystemSourceSystem operation_SyntheticSourceoperation_SyntheticSource
TelemetryTypeTelemetryTYpe typetype
URLURL urlurl
UserAccountIdUserAccountId user_AccountIduser_AccountId

后续步骤Next steps

使用日志搜索可以查看 Application Insights 应用的详细信息。Use Log Search to view detailed information for your Application Insights apps.