Mostly if you have one extension or one customer it is very easy how you want to structure your Application Insights. You just create one and query everything from there.
But what if you have more extensions or more customers and you want people give access to some extensions but not to all?
With the workspace based Application Insights (and you must migrate to that one) the data is logged into Azure Log Analytics.
So in this case Application Insights is only a “presentation” of the data inside Log Analytics. But you can give people different access on Application Insights level.
The benefit of the workspace based Application Insights is that you also can query very easily in Log Analytics and have telemetry from all your extensions or customers (if you refer it all to the same Log Analytics Workspace).
In Application Insights you can choose which Log Analytics Workspace you want ” attach”:
Then if you go to the “Log Analytics Workspace” you can also find there “Logs” to query your data.
The only difference is that the tables and columns are different from “Application Insights”.
Below are the main differences:
|Application Insights||Log Analytics Workspace|
With that case in mind if you have the following KQL query in “Application Insights”:
traces | where timestamp >= ago(3d) | where customDimensions.eventId == 'RT0005' | where customDimensions.alObjectId != '0' | where isnotempty(customDimensions.alObjectId) | extend CompanyName = tostring( customDimensions.companyName ) , SqlStatement = tostring(customDimensions.sqlStatement) , ObjectId = toint( customDimensions.alObjectId ) | project timestamp , ClientType = tostring(customDimensions.clientType) , ExecutionTimeInMS = toreal(totimespan(customDimensions.executionTime))/10000 , ObjectId , ObjectName = customDimensions.alObjectName , ObjectType = customDimensions.alObjectType , StackTrace = customDimensions.alStackTrace , SqlStatement , NumberOfJoins = countof(SqlStatement, 'JOIN') , NumberOfOuterApplys = countof(SqlStatement, 'OUTER APPLY') , takeLocks = SqlStatement has 'UPDLOCK'
That will result in the following query in “Log Analytics”
AppTraces | where TimeGenerated >= ago(3d) | where Properties.eventId == 'RT0005' | where Properties.alObjectId != '0' | where isnotempty(Properties.alObjectId) | extend CompanyName = tostring( Properties.companyName ) , SqlStatement = tostring(Properties.sqlStatement) , ObjectId = toint( Properties.alObjectId ) | project TimeGenerated , ClientType = tostring(Properties.clientType) , ExecutionTimeInMS = toreal(totimespan(Properties.executionTime))/10000 , ObjectId , ObjectName = Properties.alObjectName , ObjectType = Properties.alObjectType , StackTrace = Properties.alStackTrace , SqlStatement , NumberOfJoins = countof(SqlStatement, 'JOIN') , NumberOfOuterApplys = countof(SqlStatement, 'OUTER APPLY') , takeLocks = SqlStatement has 'UPDLOCK'
But with the last query you get data across all your “Application Insights” that is attached to your “Log Analytics Workspace”.
But if you have several “Log Analytics Workspace” and you want to query over all you can do that with the following query:
union AppTraces , workspace("a1fd7c89-4dfd-4414-9d9d-942f98e0218a").AppTraces //Workspace ID , workspace("956c3459-e448-4454-836e-06ecb9a00942").AppTraces //Workspace ID | where TimeGenerated >= ago(3d) | summarize count() by _ResourceId
Above query will result in the following: