Azure Application Insights query join on custom property-CodePudding

So I am trying to write a query for Azure Application Insights logs.

Until now, I logged custom events, so all of the properties which I wanted to show could be found in the event's customDimensions. This was easy to query, it looked something like this:

customEvents |
project
name,
Endpoint = customDimensions.Endpoint,
Context = customDimensions.Context,
...
Response = customDimensions.Response

This was fine, but now there are cases where the customDimensions.Response's value is longer than 8192 characters, which is the limit of these custom properties. For this reason, I removed the Response property, and added an EventId property instead, which is a unique Id representing each event.

The responses are now stored as traces, because the trace message limit is 32k instead of 8. In order to be able to identify which response belongs to which event, I added an EventId property to these traces too, giving it the same value as for it's custom event.

Now I am trying to write a query which could retrieve these, project the same fields it did before from customEvents, and also the Response (message) from traces, joining them on the EventId property stored in customDimensions.

Please point me in the right direction.

CodePudding user response：

So you want to join data from customEvents with the traces? Just use the join operator like this:

customEvents | project
  name, 
  Endpoint = customDimensions.Endpoint, 
  Context = customDimensions.Context,
  eventId = tostring(customDimensions.EventId)
| join kind=leftouter  
  (traces | project message, eventId = tostring(customDimensions.EventId)) on eventId