Using Azure Insights with Desktop App, need to limit certain users flooding the events

Question

We're using Azure Insights for our application.

Some users are experiencing an issue where they hit an error which is sent repeatedly, this is flooding the application insights with events and we hit our daily cap very quickly.

We have released a new version which fixes this, but for users who have not yet updated, is there a way we can block these specific events from being recieved?

Answer 1

@David McClure - Welcome to Microsoft Q&A and thanks for reaching out to us.

Yes, you could use ingestion time transformations which could work as a stop gap

With transformations in Azure Monitor, you can filter or modify incoming data before it's sent to a Log Analytics workspace.

If you’re filtering less than 50% of the overall volume, it’s no additional cost. After 50%, there is a cost much less than the standard per GB charge.

Please look at the below documents for more reference:

https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-overview?tabs=aspnetcore#telemetry-routing

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-transformations

UPDATE:

To completely ignore these events, or even block specific users without it counting towards the cap, the recommendation would be to disable the Application Insights Daily Cap (or make it huge) and rely on the Log Analytics Daily Cap w/ Ingestion-time transformations filtering out unwanted events. Filtering out data using Ingestion-time transformations does count against the Log Analytics Daily Cap, but you can filter up to half of the data for no cost (and anything above 50% is a fraction of the cost of Ingesting the data). The only prerequisite is you must be using workspace-based Application Insights.

Hope this helps. and please feel free to reach out if you have any further questions.

---

Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.