Azure Monitor 日志中的标准属性Standard properties in Azure Monitor Logs

Azure Monitor 日志中的数据以一组记录的形式存储在 Log Analytics 工作区或 Application Insights 应用程序中,每个记录都有一个特定的数据类型,每个数据类型都有一组唯一的属性。Data in Azure Monitor Logs is stored as a set of records in either a Log Analytics workspace or Application Insights application, each with a particular data type that has a unique set of properties. 许多数据类型都具有在多种类型中通用的标准属性。Many data types will have standard properties that are common across multiple types. 本文介绍这些属性,并提供如何在查询中使用它们的示例。This article describes these properties and provides examples of how you can use them in queries.

重要

如果使用的是 APM 2.1,那么 Application Insights 应用与其他所有日志数据一起存储在 Log Analytics 工作区中。If you are using APM 2.1, then Application Insights applications are stored in a Log Analytics workspace with all other log data. 表已重命名并重构,但其信息与 Application Insights 应用程序中的表相同。The tables have been renamed and restructured but have the same information as the tables in the Application Insights application. 这些新表与 Log Analytics 工作区中的其他表具有相同的标准属性。These new tables have the same standard properties as other tables in the Log Analytics workspace.

备注

一些标准属性不会在 Log Analytics 的架构视图或 intellisense 中显示,并且不会显示在查询结果中,除非你在输出中显式指定了该属性。Some of the standard properties will not show in the schema view or intellisense in Log Analytics, and they won't show in query results unless you explicitly specify the property in the output.

TimeGenerated 和 timestampTimeGenerated and timestamp

TimeGenerated(Log Analytics 工作区)和 timestamp(Application Insights 应用程序)属性包含数据源创建记录的日期和时间。The TimeGenerated (Log Analytics workspace) and timestamp (Application Insights application) properties contain the date and time that the record was created by the data source. 有关更多详细信息,请参阅 Azure Monitor 中的日志数据引入时间See Log data ingestion time in Azure Monitor for more details.

TimeGeneratedtimestamp 提供了一个用于按时间进行筛选或汇总的常用属性。TimeGenerated and timestamp provide a common property to use for filtering or summarizing by time. 为 Azure 门户中的视图或仪表板选择时间范围时,它使用 TimeGenerated 或 timestamp 来筛选结果。When you select a time range for a view or dashboard in the Azure portal, it uses TimeGenerated or timestamp to filter the results.

示例Examples

以下查询返回过去一周内每天创建的错误事件数。The following query returns the number of error events created for each day in the previous week.

Event
| where EventLevelName == "Error" 
| where TimeGenerated between(startofweek(ago(7days))..endofweek(ago(7days))) 
| summarize count() by bin(TimeGenerated, 1day) 
| sort by TimeGenerated asc 

以下查询返回过去一周内每天产生的异常数。The following query returns the number of exceptions created for each day in the previous week.

exceptions
| where timestamp between(startofweek(ago(7days))..endofweek(ago(7days))) 
| summarize count() by bin(TimeGenerated, 1day) 
| sort by timestamp asc 

_TimeReceived_TimeReceived

_TimeReceived 属性包含 Azure 云中的 Azure Monitor 引入点接收记录的日期和时间。The _TimeReceived property contains the date and time that the record was received by the Azure Monitor ingestion point in the Azure cloud. 这对于查明数据源与云之间的延迟问题非常有用。This can be useful for identifying latency issues between the data source and the cloud. 例如,网络问题会导致从代理发送数据时出现延迟。An example would be a networking issue causing a delay with data being sent from an agent. 有关更多详细信息,请参阅 Azure Monitor 中的日志数据引入时间See Log data ingestion time in Azure Monitor for more details.

对于某个代理提供的事件记录,以下查询提供了按小时计的的平均延迟。The following query gives the average latency by hour for event records from an agent. 这包括从代理到云的时间,以及记录可供日志查询使用的总时间。This includes the time from the agent to the cloud and the total time for the record to be available for log queries.

Event
| where TimeGenerated > ago(1d) 
| project TimeGenerated, TimeReceived = _TimeReceived, IngestionTime = ingestion_time() 
| extend AgentLatency = toreal(datetime_diff('Millisecond',TimeReceived,TimeGenerated)) / 1000
| extend TotalLatency = toreal(datetime_diff('Millisecond',IngestionTime,TimeGenerated)) / 1000
| summarize avg(AgentLatency), avg(TotalLatency) by bin(TimeGenerated,1hr)

Type 和 itemTypeType and itemType

Type(Log Analytics 工作区)和 itemType(Application Insights 应用程序)属性包含从中检索记录的表的名称,也可将其视为记录类型。The Type (Log Analytics workspace) and itemType (Application Insights application) properties hold the name of the table that the record was retrieved from which can also be thought of as the record type. 此属性在将多个表的记录进行组合的查询中非常有用,例如,使用 search 运算符区分不同类型的记录的那些查询。This property is useful in queries that combine records from multiple tables, such as those that use the search operator, to distinguish between records of different types. 在某些地方, $table 可以用来替代 Type$table can be used in place of Type in some places.

示例Examples

以下查询返回过去一小时内按类型收集的记录计数。The following query returns the count of records by type collected over the past hour.

search * 
| where TimeGenerated > ago(1h)
| summarize count() by Type

_ItemId_ItemId

_ItemId 属性包含记录的唯一标识符。The _ItemId property holds a unique identifier for the record.

_ResourceId_ResourceId

_ResourceId 属性包含与记录关联的资源的唯一标识符。The _ResourceId property holds a unique identifier for the resource that the record is associated with. 这为你提供了一个标准属性,用于将查询范围限定为仅来自特定资源的记录,或者跨多个表联接相关数据。This gives you a standard property to use to scope your query to only records from a particular resource, or to join related data across multiple tables.

对于 Azure 资源, _ResourceId 的值是 Azure 资源 ID URLFor Azure resources, the value of _ResourceId is the Azure resource ID URL. 该属性目前仅限于 Azure 资源,但它将扩展到 Azure 之外的资源,例如本地计算机。The property is currently limited to Azure resources, but it will be extended to resources outside of Azure such as on-premises computers.

备注

某些数据类型已具有包含 Azure 资源 ID 或至少包含其一部分(例如订阅 ID)的字段。Some data types already have fields that contain Azure resource ID or at least parts of it like subscription ID. 虽然为了实现向后兼容而保留了这些字段,但是建议使用 _ResourceId 来执行交叉关联,因为它将更为一致。While these fields are kept for backward compatibility, it is recommended to use the _ResourceId to perform cross correlation since it will be more consistent.

示例Examples

以下查询联接每台计算机的性能和事件数据。The following query joins performance and event data for each computer. 它显示 ID 为 101 且处理器利用率超过 50% 的所有事件。It shows all events with an ID of 101 and processor utilization over 50%.

Perf 
| where CounterName == "% User Time" and CounterValue  > 50 and _ResourceId != "" 
| join kind=inner (     
    Event 
    | where EventID == 101 
) on _ResourceId

以下查询将 AzureActivity 记录与 SecurityEvent 记录进行联接。The following query joins AzureActivity records with SecurityEvent records. 它显示了登录到这些计算机的用户的所有活动操作。It shows all activity operations with users that were logged in to these machines.

AzureActivity 
| where  
    OperationName in ("Restart Virtual Machine", "Create or Update Virtual Machine", "Delete Virtual Machine")  
    and ActivityStatus == "Succeeded"  
| join kind= leftouter (    
   SecurityEvent 
   | where EventID == 4624  
   | summarize LoggedOnAccounts = makeset(Account) by _ResourceId 
) on _ResourceId  

以下查询分析 _ResourceId 并聚合每个 Azure 订阅的计费数据量。The following query parses _ResourceId and aggregates billed data volumes per Azure subscription.

union withsource = tt * 
| where _IsBillable == true 
| parse tolower(_ResourceId) with "/subscriptions/" subscriptionId "/resourcegroups/" 
    resourceGroup "/providers/" provider "/" resourceType "/" resourceName   
| summarize Bytes=sum(_BilledSize) by subscriptionId | sort by Bytes nulls last 

请谨慎使用这些 union withsource = tt * 查询,因为跨数据类型执行扫描的开销很大。Use these union withsource = tt * queries sparingly as scans across data types are expensive to execute.

_IsBillable_IsBillable

_IsBillable 属性指定是否对引入的数据进行计费。The _IsBillable property specifies whether ingested data is billable. _IsBillable 等于 false 的数据是免费收集的,系统不会向你的 Azure 帐户收费。Data with _IsBillable equal to false are collected for free and not billed to your Azure account.

示例Examples

若要获取发送计费数据类型的计算机列表,请使用以下查询:To get a list of computers sending billed data types, use the following query:

备注

请谨慎使用带 union withsource = tt * 的查询,因为跨数据类型执行扫描的开销很大。Use queries with union withsource = tt * sparingly as scans across data types are expensive to execute.

union withsource = tt * 
| where _IsBillable == true 
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != ""
| summarize TotalVolumeBytes=sum(_BilledSize) by computerName

这可以扩展为返回每小时发送计费数据类型的计算机数量:This can be extended to return the count of computers per hour that are sending billed data types:

union withsource = tt * 
| where _IsBillable == true 
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != ""
| summarize dcount(computerName) by bin(TimeGenerated, 1h) | sort by TimeGenerated asc

_BilledSize_BilledSize

_BilledSize 属性指定 _IsBillable 为 true 时将向 Azure 帐户计费的数据字节大小。The _BilledSize property specifies the size in bytes of data that will be billed to your Azure account if _IsBillable is true.

示例Examples

若要查看每台计算机引入的可计费事件的大小,请使用 _BilledSize 属性(以字节为单位提供大小):To see the size of billable events ingested per computer, use the _BilledSize property which provides the size in bytes:

union withsource = tt * 
| where _IsBillable == true 
| summarize Bytes=sum(_BilledSize) by  Computer | sort by Bytes nulls last 

若要查看每个订阅引入的可计费事件大小,请使用以下查询:To see the size of billable events ingested per subscription, use the following query:

union withsource=table * 
| where _IsBillable == true 
| parse _ResourceId with "/subscriptions/" SubscriptionId "/" *
| summarize Bytes=sum(_BilledSize) by  SubscriptionId | sort by Bytes nulls last 

若要查看每个资源组引入的可计费事件大小,请使用以下查询:To see the size of billable events ingested per resource group, use the following query:

union withsource=table * 
| where _IsBillable == true 
| parse _ResourceId with "/subscriptions/" SubscriptionId "/resourcegroups/" ResourceGroupName "/" *
| summarize Bytes=sum(_BilledSize) by  SubscriptionId, ResourceGroupName | sort by Bytes nulls last 

若要查看每台计算机引入的事件数,请使用以下查询:To see the count of events ingested per computer, use the following query:

union withsource = tt *
| summarize count() by Computer | sort by count_ nulls last

若要查看每台计算机引入的可计费事件数,请使用以下查询:To see the count of billable events ingested per computer, use the following query:

union withsource = tt * 
| where _IsBillable == true 
| summarize count() by Computer  | sort by count_ nulls last

若要查看特定计算机的可计费数据类型的计数,请使用以下查询:To see the count of billable data types from a specific computer, use the following query:

union withsource = tt *
| where Computer == "computer name"
| where _IsBillable == true 
| summarize count() by tt | sort by count_ nulls last 

后续步骤Next steps