Azure Monitor 查询中的 app() 表达式app() expression in Azure Monitor query

app 表达式用于 Azure Monitor 查询中,可从特定 Application Insights 应用中的同一资源组、另一个资源组或另一个订阅中检索数据。The app expression is used in an Azure Monitor query to retrieve data from a specific Application Insights app in the same resource group, another resource group, or another subscription. 此表达式适用于在 Azure Monitor 日志查询中包含应用程序数据以及在 Application Insights 查询中跨多个应用程序查询数据。This is useful to include application data in an Azure Monitor log query and to query data across multiple applications in an Application Insights query.


如果使用的是基于工作区的 Application Insights 资源,则不使用 app() 表达式,因为日志数据存储在 Log Analytics 工作区中。The app() expression is not used if you're using a workspace-based Application Insights resource since log data is stored in a Log Analytics workspace. 使用 workspace() 表达式编写一个查询,使其在多个工作区中包含应用。Use the workspace() expression to write a query that includes application in multiple workspaces. 对于同一个工作区中的多个应用,则无需跨工作区查询。For multiple applications in the same workspace, you don't need a cross workspace query.




  • 标识符:使用下表中的某种格式标识应用。Identifier: Identifies the app using one of the formats in the table below.
标识符Identifier 说明Description 示例Example
资源名称Resource Name 人工可读的应用名称(也称为“组件名称”)Human readable name of the app (Also known as "component name") app("fabrikamapp")app("fabrikamapp")
限定的名称Qualified Name 窗体中应用的完整名称:“subscriptionName/resourceGroup/componentName”Full name of the app in the form: "subscriptionName/resourceGroup/componentName" app('AI-Prototype/Fabrikam/fabrikamapp')app('AI-Prototype/Fabrikam/fabrikamapp')
IDID 应用的 GUIDGUID of the app app("988ba129-363e-4415-8fe7-8cbab5447518")app("988ba129-363e-4415-8fe7-8cbab5447518")
Azure 资源 IDAzure Resource ID Azure 资源的标识符Identifier for the Azure resource app("/subscriptions/7293b69-db12-44fc-9a66-9c2005c3051d/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp")app("/subscriptions/7293b69-db12-44fc-9a66-9c2005c3051d/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp")


  • 必须具有该应用程序的读取权限。You must have read access to the application.
  • 按应用程序的名称来标识应用程序,即假定该名称在所有可访问订阅中唯一。Identifying an application by its name assumes that it is unique across all accessible subscriptions. 如果拥有多个采用指定名称的应用程序,查询将因多义性而失败。If you have multiple applications with the specified name, the query will fail because of the ambiguity. 在这种情况下,必须使用一个其他的标识符。In this case you must use one of the other identifiers.
  • 使用相关表达式 workspace 来跨 Log Analytics 工作区进行查询。Use the related expression workspace to query across Log Analytics workspaces.
  • 除非使用 Application Insights 应用程序作为警报规则的资源,否则在使用 Azure 门户创建自定义日志搜索警报规则时,搜索查询目前不支持 app() 表达式。The app() expression is currently not supported in the search query when using the Azure portal to create a custom log search alert rule, unless an Application Insights application is used as the resource for the alert rule.


app("fabrikamapp").requests | count
app("AI-Prototype/Fabrikam/fabrikamapp").requests | count
app("b438b4f6-912a-46d5-9cb1-b44069212ab4").requests | count
app("/subscriptions/7293b69-db12-44fc-9a66-9c2005c3051d/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp").requests | count
(workspace("myworkspace").Heartbeat | where Computer contains "Con"),
(app("myapplication").requests | where cloud_RoleInstance contains "Con")
| count  
(workspace("myworkspace").Heartbeat), (app("myapplication").requests)
| where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))

后续步骤Next steps