Skip to content

Alert-Logs-Application Insight

Application logs Monitoring and Alerting with Azure Application Insights

To check Application Insights logs and run Kusto Query Language (KQL) queries, follow these steps:
1. Access Azure Portal:
  • Go to the Azure Portal and sign in with your Azure account.
2. Navigate to Application Insights:
  • In the Azure Portal, search for and select your Application Insights resource. Application Insights provides various experiences to enhance the performance, reliability, and quality of your applications. These include:
  • Application dashboard: An at-a-glance assessment of the application’s health and performance.
  • Investigate options include:
    • Application map: A visual overview of application architecture and components' interactions.
    • Live metrics: A real-time analytics dashboard for insight into application activity and performance.
    • Transaction search: Trace and diagnose transactions to identify issues and optimize performance.
    • Performance view: Review application performance metrics and potential bottlenecks.
    • Failures view: Identify and analyze failures in your application to minimize downtime.
  • Monitoring options include:
    • Alerts: Monitor a wide range of aspects of your application and trigger various actions.
    • Metrics: Dive deep into metrics data to understand usage patterns and trends.
    • Diagnostic settings: Configure streaming export of platform logs and metrics to the destination of your choice.
    • Logs: Retrieve, consolidate, and analyze all data collected into Azure Monitoring Logs.
3. View Logs:
  • Once you're in the Application Insights resource, you can view logs in a few different ways:
a. Live metrics:

Click on "Live metrics" in the left-hand menu. This will take you to a real-time analytics dashboard for insight into application activity and performance. There, you can see "view in logs." Click it to open, and now you can query your logs using custom KQL or use sample queries to check logs. Note that this live feature is only available for frontend web applications. Other backend apps don't support this.

b. Transactions or Failures:

You can also navigate to specific sections like "Transactions" or "Failures," and then click on specific transactions or failures to view their details and associated logs.

4. Write KQL Queries:

In the Application Insights Analytics portal, you can write Kusto Query Language (KQL) queries to retrieve and analyze logs. Here's an example KQL query to get you started:

// Check the status code of the web app
AzureMetrics 
| where TimeGenerated > ago(12h)  
| where MetricName in ("Http2xx", "Http3xx", "Http4xx", "Http5xx") 
| summarize sum(Total) by MetricName  
| render piechart

You can modify and expand these queries according to your specific needs. KQL is a powerful query language that allows you to filter, transform, and aggregate data as required.

Additionally, for all Application Insights logs, we are currently collecting them and feeding them to an Azure Analytics workspace. Just like in Application Insights, where you can go to look for logs, on the left side, you have the option to click on "Logs" to open the same interface as Application Insights. Here, you can query all the logs that are coming from each Application Insight, including diagnostic logs sent by the web app. For example:

// See all the requests coming to the web app
AzureMetrics
| where MetricName contains "Requests"

// Top 10 Machines 
// Top 10 machines generating traffic.
AppServiceHTTPLogs
| top-nested 10 of CIp by count()

// All requests made 
AppRequests

This allows you to analyze and query logs from all your Application Insights resources in one centralized location, making it easier to monitor and manage your application's performance and troubleshoot issues.

5. Run Queries:

After writing your KQL query, click the "Run" button to execute the query. The results will be displayed in the query results pane.

6. Export and Visualize Data:

You can export query results to various formats (CSV, JSON) or create visualizations using the "Chart" option. You can also pin the results to a dashboard and monitor the data.

7. Creating an Alert:

You can set up alerts in Application Insights to notify you when certain conditions are met in your application's data. Alerts help you proactively monitor and respond to issues. Here's how you can create an alert:

a. Define Alert Conditions:

In the Application Insights resource, navigate to the "Alerts" section, which you can find in the left-hand menu.

b. Create a New Alert Rule:

  • Click on "New alert rule" to define the conditions for the alert.

    • For example, when creating a rule, you need to select the scope, write the condition, or create rules directly from a custom query. For example:

    AzureMetrics
| where MetricName == "HealthyHostCount"
| project Resource, ResourceGroup, TimeGenerated, HealthyHostCount=Count

AppRequests 
| where ResultCode == 500 
| project TimeGenerated, Url, Type, ItemCount,_ResourceId, ResultCode
    - Select the measurement, alert logic, operator, threshold value, and frequency of evaluation.

c. Configure Alert Criteria:

Specify the criteria for alert, such as "When the ItemCount exceeds 1 for more than 5 minutes" or "When the response time exceeds 500 milliseconds for more than 5 minutes."

d. Set Alert Thresholds:

Determine the threshold values that trigger the alert. Customize thresholds based on your application's requirements.

e. Notification Settings:

Choose how you want to be notified when the alert conditions are met. Set up email notifications, integrate with other services like Azure Logic Apps, or use other notification channels.

f. Test and Save Alert:

Before saving the alert rule, you can test it to ensure it functions as expected. Once you're satisfied with the alert configuration, save the alert rule.

g. Activate the Alert Rule:

After saving the rule, make sure to activate it. This ensures that the alert is actively monitoring your application for the specified conditions.

h. Monitor Alerts:

View and manage your active alerts in the "Alerts" section of Application Insights. This allows you to keep track of when alerts are triggered and the actions taken in response.

Setting up alerts in Application Insights is crucial for proactive monitoring and timely response to issues in your applications, helping you maintain optimal performance and minimize downtime.