统一多个 Azure Monitor Application Insights 资源Unify multiple Azure Monitor Application Insights resources

• 08/22/2019
• • 

本文介绍如何在一个位置查询和查看所有 Application Insights 应用程序日志数据（即使这些数据位于不同 Azure 订阅），可作为弃用 Application Insights 连接器的替换方式。This article describes how to query and view all your Application Insights application log data in one place, even when they are in different Azure subscriptions, as a replacement for the deprecation of the Application Insights Connector. 可以在单个查询中包含的资源（Application Insights 资源）数量限制为 100。The number of resources Application Insights resources that you can include in a single query is limited to 100.

用于查询多个 Application Insights 资源的建议做法Recommended approach to query multiple Application Insights resources

在查询中列出多个 Application Insights 资源可能很繁琐且难以维护。Listing multiple Application Insights resources in a query can be cumbersome and difficult to maintain. 可以改为利用函数将查询逻辑从应用程序范围中分离出来。Instead, you can leverage function to separate the query logic from the applications scoping.

本示例演示了如何监视多个 Application Insights 资源，并按应用程序名称显示失败请求的计数。This example demonstrates how you can monitor multiple Application Insights resources and visualize the count of failed requests by application name. 开始之前，请在该连接到 Application Insights 资源的工作区中运行查询，获取已连接应用程序的列表：Before you begin, run this query in the workspace that is connected to Application Insights resources to get the list of connected applications:

ApplicationInsights
| summarize by ApplicationName

使用 union 运算符和应用程序列表创建函数，然后在工作区中使用别名 applicationsScoping 将该查询保存为函数。Create a function using union operator with the list of applications, then save the query in your workspace as function with the alias applicationsScoping.

可以通过导航到工作区中的查询资源管理器，然后选择要编辑的函数并保存，或使用 SavedSearch PowerShell cmdlet 来随时修改列出的应用程序。You can modify the listed applications at any time in the portal by navigating to Query explorer in your workspace and selecting the function for editing and then saving, or using the SavedSearch PowerShell cmdlet.

withsource= SourceApp 命令可向结果添加用于指定发送日志的应用程序的列。The withsource= SourceApp command adds a column to the results that designates the application that sent the log. 本示例中的 parse 运算符为可选项，用于从 SourceApp 属性中提取应用程序名称。The parse operator is optional in this example and uses to extracts the application name from SourceApp property.

union withsource=SourceApp 
app('Contoso-app1').requests,  
app('Contoso-app2').requests, 
app('Contoso-app3').requests, 
app('Contoso-app4').requests, 
app('Contoso-app5').requests 
| parse SourceApp with * "('" applicationName "')" *  

现在便可以在跨资源查询中使用 applicationsScoping 函数：You are now ready to use applicationsScoping function in the cross-resource query:

applicationsScoping 
| where timestamp > ago(12h)
| where success == 'False'
| parse SourceApp with * '(' applicationName ')' * 
| summarize count() by applicationName, bin(timestamp, 1h) 
| render timechart

虽然是在工作区中执行查询，但该查询使用 Application Insights 架构，因为 applicationsScoping 函数会返回 Application Insights 数据结构。The query uses Application Insights schema, although the query is executed in the workspace since the applicationsScoping function returns the Application Insights data structure. 函数别名返回来自所有已定义应用程序的请求的并集。The function alias returns the union of the requests from all the defined applications. 然后，查询筛选失败的请求，并按应用程序显示趋势。The query then filters for failed requests and visualizes the trends by application.

跨 Application Insights 资源和工作区数据的查询Query across Application Insights resources and workspace data

停止连接器时，如果需要在 Application Insights 数据保留（90 天）调整的时间范围内执行查询，则需于中期在工作区和 Application Insights 资源上执行跨资源查询。When you stop the Connector and need to perform queries over a time range that was trimmed by Application Insights data retention (90 days), you need to perform cross-resource queries on the workspace and Application Insights resources for an intermediate period. 应用程序数据按照上述新的 Application Insights 数据保留累积之前均是如此。This is until your applications data accumulates per the new Application Insights data retention mentioned above. 由于 Application Insights 和工作区中的架构不同，因此查询需要一些操作。The query requires some manipulations since the schemas in Application Insights and the workspace are different. 请参阅本节后面的表格，其中突出显示了架构差异。See the table later in this section highlighting the schema differences.

例如，如果连接器于 2018 年 11 月 1 日停止工作，则在 Application Insights 资源和工作区中的应用程序数据之间查询日志时，查询的构造方式类似于以下示例：For example, if the connector stopped working on 2018-11-01, when you query logs across Application Insights resources and applications data in the workspace, your query would be constructed like the following example:

applicationsScoping //this brings data from Application Insights resources 
| where timestamp between (datetime("2018-11-01") .. now()) 
| where success == 'False' 
| where duration > 1000 
| union ( 
    ApplicationInsights //this is Application Insights data in Log Analytics workspace 
    | where TimeGenerated < (datetime("2018-12-01") 
    | where RequestSuccess == 'False' 
    | where RequestDuration > 1000 
    | extend duration = RequestDuration //align to Application Insights schema 
    | extend timestamp = TimeGenerated //align to Application Insights schema 
    | extend name = RequestName //align to Application Insights schema 
    | extend resultCode = ResponseCode //align to Application Insights schema 
    | project-away RequestDuration , RequestName , ResponseCode , TimeGenerated 
) 
| project timestamp , duration , name , resultCode 

Application Insights 和 Log Analytics 工作区的架构差异Application Insights and Log Analytics workspace schema differences

下表显示了 Log Analytics 和 Application Insights 之间的架构差异。The following table shows the schema differences between Log Analytics and Application Insights.

后续步骤Next steps

使用日志搜索可以查看 Application Insights 应用的详细信息。Use Log Search to view detailed information for your Application Insights apps.