Application Insights - 如何在交叉引用查询中引用所有表

Question

我有多个 Application Insights 被相关的多个 API 应用引用，如下所示。 API1 - AI1（应用程序 1 链接到名为 ai1 的 Application Insights 1） API2 - AI2（应用程序 2 链接到名为 ai2 的 Application Insights 2） API3 - AI3（Application 3 链接到名为 ai3 的 Application Insights 3） 等等。 API1 调用 API2 调用 API3 现在，我需要在交叉引用查询中从所有三个 Application Insights 中提取所有信息（例如：请求、依赖项、事件等）。

union     
(
app('ai1').requests
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai1').dependencies
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai2').requests
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai2').dependencies
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai3').requests
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai3').dependencies
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
)

上述查询完美运行。您可能会注意到查询并不精确。有没有办法，我可以将所有类型的表合并为一个，以便我的查询简单而精确，如下所示。

union 
(
app('ai1').**union**
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai2').**union**
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
app('ai3').**union**
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
)

Answer 1

您也可以在门户的 Azure Workbooks 中执行此操作，但是，您的查询实际上只是

，而不是在查询文本中传递所有应用程序 ID

union requests, dependencies
| where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"

然后您可以从资源选择器中选择要针对哪些应用运行查询，这允许多选。

您还可以将操作 id、表格、时间范围、资源转换为参数等：

该工作簿作为 json 的工作示例：

{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "crossComponentResources": [
          "value::selected"
        ],
        "parameters": [
          {
            "id": "75168f58-a753-45aa-97d9-89bf8f99d18e",
            "version": "KqlParameterItem/1.0",
            "name": "timeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 86400000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "4e02493e-dbbe-478a-8992-d0897a4cb92c",
            "version": "KqlParameterItem/1.0",
            "name": "operationId",
            "type": 1,
            "isRequired": true,
            "value": "eec42c35781a8e4199c420b8fda7bf87",
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "6a545372-8f82-43bc-b77c-9074c1ff18d0",
            "version": "KqlParameterItem/1.0",
            "name": "tables",
            "label": "Tables",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "",
            "delimiter": ",",
            "value": [
              "requests",
              "dependencies"
            ],
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "jsonData": "[\"requests\", \"dependencies\", \"traces\", \"exceptions\"]",
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "da2d5bd6-cdfe-43c1-b6d6-0a211d74953b",
            "version": "KqlParameterItem/1.0",
            "name": "Resources",
            "type": 5,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "resources | where type =~ \"microsoft.insights/components\"\r\n| project id, name, selected=0, group=resourceGroup | order by 1 asc",
            "crossComponentResources": [
              "value::selected"
            ],
            "value": [
            ],
            "typeSettings": {
              "limitSelectTo": 10,
              "additionalResourceOptions": []
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          }
        ],
        "style": "above",
        "queryType": 1,
        "resourceType": "microsoft.resourcegraph/resources"
      },
      "name": "parameters - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union {tables}\r\n| where operation_Id == \"{operationId}\"",
        "size": 0,
        "title": "Operation \"{operationId}\" in {tables} over {timeRange:label}",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "timeRange",
        "queryType": 0,
        "resourceType": "microsoft.insights/components",
        "crossComponentResources": [
          "{Resources}"
        ]
      },
      "name": "query - 1"
    }
  ],
  "fallbackResourceIds": [
    "Azure Monitor"
  ],
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}

Answer 2

实际上，您不能将所有类型的表合并为一个，例如使用app('ai1').**union**。 requests、dependencies 等必须明确指定。如果我误解了你，请纠正我。

或者，您可以使用如下查询：

union 
(
 union app("ai1").requests, app("ai1").dependencies
 | where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
 union app("ai2").requests, app("ai2").dependencies
 | where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
),
(
 union app("ai3").requests, app("ai3").dependencies
 | where operation_Id == "eec42c35781a8e4199c420b8fda7bf87"
)