Unify multiple Azure Monitor Application Insights resources
This article describes how to query and view all your Application Insights log data in one place, even when they are in different Azure subscriptions, as a replacement for the deprecation of the Application Insights Connector. The number of Application Insights resources that you can include in a single query is limited to 100.
Recommended approach to query multiple Application Insights resources
Listing multiple Application Insights resources in a query can be cumbersome and difficult to maintain. Instead, you can leverage function to separate the query logic from the applications scoping.
This example demonstrates how you can monitor multiple Application Insights resources and visualize the count of failed requests by application name.
Create a function using union operator with the list of applications, then save the query in your workspace as function with the alias applicationsScoping.
You can modify the listed applications at any time in the portal by navigating to Query explorer in your workspace and selecting the function for editing and then saving, or using the
SavedSearch PowerShell cmdlet.
This method can’t be used with log alerts because the access validation of the alert rule resources, including workspaces and applications, is performed at alert creation time. Adding new resources to the function after the alert creation isn’t supported. If you prefer to use function for resource scoping in log alerts, you need to edit the alert rule in the portal or with a Resource Manager template to update the scoped resources. Alternatively, you can include the list of resources in the log alert query.
withsource= SourceApp command adds a column to the results that designates the application that sent the log. The parse operator is optional in this example and uses to extracts the application name from SourceApp property.
union withsource=SourceApp app('Contoso-app1').requests, app('Contoso-app2').requests, app('Contoso-app3').requests, app('Contoso-app4').requests, app('Contoso-app5').requests | parse SourceApp with * "('" applicationName "')" *
You are now ready to use applicationsScoping function in the cross-resource query:
applicationsScoping | where timestamp > ago(12h) | where success == 'False' | parse SourceApp with * '(' applicationName ')' * | summarize count() by applicationName, bin(timestamp, 1h) | render timechart
The query uses Application Insights schema, although the query is executed in the workspace since the applicationsScoping function returns the Application Insights data structure. The function alias returns the union of the requests from all the defined applications. The query then filters for failed requests and visualizes the trends by application.
Cross-resource query in log alerts is supported in the new scheduledQueryRules API. By default, Azure Monitor uses the legacy Log Analytics Alert API for creating new log alert rules from Azure portal, unless you switch from legacy Log Alerts API. After the switch, the new API becomes the default for new alert rules in Azure portal and it lets you create cross-resource query log alerts rules. You can create cross-resource query log alert rules without making the switch by using the ARM template for scheduledQueryRules API – but this alert rule is manageable though scheduledQueryRules API and not from Azure portal.
Application Insights and Log Analytics workspace schema differences
The following table shows the schema differences between Log Analytics and Application Insights.
|Log Analytics workspace properties||Application Insights resource properties|
Use Log Search to view detailed information for your Application Insights apps.