统一多个 Azure Monitor Application Insights 资源Unify multiple Azure Monitor Application Insights resources

本文介绍如何在一个位置查询和查看所有 Application Insights 应用程序日志数据(即使这些数据位于不同 Azure 订阅),可作为弃用 Application Insights 连接器的替换方式。This article describes how to query and view all your Application Insights application log data in one place, even when they are in different Azure subscriptions, as a replacement for the deprecation of the Application Insights Connector. 可以在单个查询中包含的资源(Application Insights 资源)数量限制为 100。The number of resources Application Insights resources that you can include in a single query is limited to 100.

在查询中列出多个 Application Insights 资源可能很繁琐且难以维护。Listing multiple Application Insights resources in a query can be cumbersome and difficult to maintain. 可以改为利用函数将查询逻辑从应用程序范围中分离出来。Instead, you can leverage function to separate the query logic from the applications scoping.

本示例演示了如何监视多个 Application Insights 资源,并按应用程序名称显示失败请求的计数。This example demonstrates how you can monitor multiple Application Insights resources and visualize the count of failed requests by application name. 开始之前,请在该连接到 Application Insights 资源的工作区中运行查询,获取已连接应用程序的列表:Before you begin, run this query in the workspace that is connected to Application Insights resources to get the list of connected applications:

ApplicationInsights
| summarize by ApplicationName

使用 union 运算符和应用程序列表创建函数,然后在工作区中使用别名 applicationsScoping 将该查询保存为函数。Create a function using union operator with the list of applications, then save the query in your workspace as function with the alias applicationsScoping.

可以通过导航到工作区中的查询资源管理器,然后选择要编辑的函数并保存,或使用 SavedSearch PowerShell cmdlet 来随时修改列出的应用程序。You can modify the listed applications at any time in the portal by navigating to Query explorer in your workspace and selecting the function for editing and then saving, or using the SavedSearch PowerShell cmdlet.

Note

此方法不能用于日志警报,因为警报规则资源(包括工作区和应用程序)的访问验证是在警报创建时执行的。This method can�t be used with log alerts because the access validation of the alert rule resources, including workspaces and applications, is performed at alert creation time. 不支持在创建警报后将新资源添加到该函数。Adding new resources to the function after the alert creation isn�t supported. 如果更喜欢使用函数在日志警报中确定资源范围,则需要在门户中编辑警报规则或使用资源管理器模板来更新范围内的资源。If you prefer to use function for resource scoping in log alerts, you need to edit the alert rule in the portal or with a Resource Manager template to update the scoped resources. 或者,可以在日志警报查询中包含资源列表。Alternatively, you can include the list of resources in the log alert query.

withsource= SourceApp 命令可向结果添加用于指定发送日志的应用程序的列。The withsource= SourceApp command adds a column to the results that designates the application that sent the log. 本示例中的 parse 运算符为可选项,用于从 SourceApp 属性中提取应用程序名称。The parse operator is optional in this example and uses to extracts the application name from SourceApp property.

union withsource=SourceApp 
app('Contoso-app1').requests,  
app('Contoso-app2').requests, 
app('Contoso-app3').requests, 
app('Contoso-app4').requests, 
app('Contoso-app5').requests 
| parse SourceApp with * "('" applicationName "')" *  

现在便可以在跨资源查询中使用 applicationsScoping 函数:You are now ready to use applicationsScoping function in the cross-resource query:

applicationsScoping 
| where timestamp > ago(12h)
| where success == 'False'
| parse SourceApp with * '(' applicationName ')' * 
| summarize count() by applicationName, bin(timestamp, 1h) 
| render timechart

虽然是在工作区中执行查询,但该查询使用 Application Insights 架构,因为 applicationsScoping 函数会返回 Application Insights 数据结构。The query uses Application Insights schema, although the query is executed in the workspace since the applicationsScoping function returns the Application Insights data structure. 函数别名返回来自所有已定义应用程序的请求的并集。The function alias returns the union of the requests from all the defined applications. 然后,查询筛选失败的请求,并按应用程序显示趋势。The query then filters for failed requests and visualizes the trends by application.

跨查询结果示例

跨 Application Insights 资源和工作区数据的查询Query across Application Insights resources and workspace data

停止连接器时,如果需要在 Application Insights 数据保留(90 天)调整的时间范围内执行查询,则需于中期在工作区和 Application Insights 资源上执行跨资源查询When you stop the Connector and need to perform queries over a time range that was trimmed by Application Insights data retention (90 days), you need to perform cross-resource queries on the workspace and Application Insights resources for an intermediate period. 应用程序数据按照上述新的 Application Insights 数据保留累积之前均是如此。This is until your applications data accumulates per the new Application Insights data retention mentioned above. 由于 Application Insights 和工作区中的架构不同,因此查询需要一些操作。The query requires some manipulations since the schemas in Application Insights and the workspace are different. 请参阅本节后面的表格,其中突出显示了架构差异。See the table later in this section highlighting the schema differences.

例如,如果连接器于 2018 年 11 月 1 日停止工作,则在 Application Insights 资源和工作区中的应用程序数据之间查询日志时,查询的构造方式类似于以下示例:For example, if the connector stopped working on 2018-11-01, when you query logs across Application Insights resources and applications data in the workspace, your query would be constructed like the following example:

applicationsScoping //this brings data from Application Insights resources 
| where timestamp between (datetime("2018-11-01") .. now()) 
| where success == 'False' 
| where duration > 1000 
| union ( 
    ApplicationInsights //this is Application Insights data in Log Analytics workspace 
    | where TimeGenerated < (datetime("2018-12-01") 
    | where RequestSuccess == 'False' 
    | where RequestDuration > 1000 
    | extend duration = RequestDuration //align to Application Insights schema 
    | extend timestamp = TimeGenerated //align to Application Insights schema 
    | extend name = RequestName //align to Application Insights schema 
    | extend resultCode = ResponseCode //align to Application Insights schema 
    | project-away RequestDuration , RequestName , ResponseCode , TimeGenerated 
) 
| project timestamp , duration , name , resultCode 

Application Insights 和 Log Analytics 工作区的架构差异Application Insights and Log Analytics workspace schema differences

下表显示了 Log Analytics 和 Application Insights 之间的架构差异。The following table shows the schema differences between Log Analytics and Application Insights.

Log Analytics 工作区属性Log Analytics workspace properties Application Insights 资源属性Application Insights resource properties
AnonUserIdAnonUserId user_iduser_id
ApplicationIdApplicationId appIdappId
ApplicationNameApplicationName appNameappName
ApplicationTypeVersionApplicationTypeVersion application_Versionapplication_Version
AvailabilityCountAvailabilityCount itemCountitemCount
AvailabilityDurationAvailabilityDuration durationduration
AvailabilityMessageAvailabilityMessage messagemessage
AvailabilityRunLocationAvailabilityRunLocation locationlocation
AvailabilityTestIdAvailabilityTestId idid
AvailabilityTestNameAvailabilityTestName namename
AvailabilityTimestampAvailabilityTimestamp timestamptimestamp
浏览器Browser client_browserclient_browser
城市City client_cityclient_city
ClientIPClientIP client_IPclient_IP
ComputerComputer cloud_RoleInstancecloud_RoleInstance
国家/地区Country client_CountryOrRegionclient_CountryOrRegion
CustomEventCountCustomEventCount itemCountitemCount
CustomEventDimensionsCustomEventDimensions customDimensionscustomDimensions
CustomEventNameCustomEventName namename
DeviceModelDeviceModel client_Modelclient_Model
DeviceTypeDeviceType client_typeclient_Type
ExceptionCountExceptionCount itemCountitemCount
ExceptionHandledAtExceptionHandledAt handledAthandledAt
ExceptionMessageExceptionMessage messagemessage
ExceptionTypeExceptionType typetype
OperationIDOperationID operation_Idoperation_id
OperationNameOperationName operation_Nameoperation_Name
操作系统OS client_OSclient_OS
PageViewCountPageViewCount itemCountitemCount
PageViewDurationPageViewDuration durationduration
PageViewNamePageViewName namename
ParentOperationIDParentOperationID operation_Idoperation_Id
RequestCountRequestCount itemCountitemCount
RequestDurationRequestDuration durationduration
RequestIDRequestID idid
RequestNameRequestName namename
RequestSuccessRequestSuccess successsuccess
ResponseCodeResponseCode resultCoderesultCode
角色Role cloud_RoleNamecloud_RoleName
RoleInstanceRoleInstance cloud_RoleInstancecloud_RoleInstance
SessionIdSessionId session_Idsession_Id
SourceSystemSourceSystem operation_SyntheticSourceoperation_SyntheticSource
TelemetryTypeTelemetryTYpe typetype
URLURL _url_url
UserAccountIdUserAccountId user_AccountIduser_AccountId

后续步骤Next steps

使用日志搜索可以查看 Application Insights 应用的详细信息。Use Log Search to view detailed information for your Application Insights apps.