问题描述
我正在使用Azure Log Analytics查询源自AppCenter Diagnostics的Azure Application Insights中的日志条目.在某些日志条目中，我使用自定义属性.现在，我试图编写一个查询以仅显示具有给定值的某些属性的值.
I'm querying log entries in Azure Application Insights originating from AppCenter Diagnostics using Azure Log Analytics.In some log entries i use custom propertys.Now i'm trying to write a query to show values only with certain properties having a given value.
我的原始查询如下所示，并产生预期的结果:
My original query looks like this and produces the expected result:
customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z))
| top 101 by timestamp desc
| project timestamp, name, customDimensions.Properties
| where name == "Navigated to details view"
将鼠标悬停在"productId"属性上会显示一个加号，该加号允许添加过滤条件:
Hovering over the "productId" property shows a plus-sign which allows to add a filter criteria:
选择此选项扩展了我的查询范围:
Choosing this options extends my query:
customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z))
| top 101 by timestamp desc
| project timestamp, name, customDimensions.Properties
| where name == "Navigated to details view"
| where customDimensions_Properties.productId == 4711
到目前为止，太好了.如果现在尝试运行此查询，则会收到消息找不到结果":
So far, so good. If i now try to run this query i get the message "NO RESULTS FOUND":
我还尝试将底部的where子句添加到第一个where子句
I also tried adding the where clause on the bottom to the first where clause
customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z))
and name == "Navigated to details view"
and customDimensions.Properties.productId == 4711
| top 101 by timestamp desc
| project timestamp, name, customDimensions
很不幸，也没有结果.
我还尝试了此查询，以查看是否可以将查询中的productId属性投影到where子句中:
Edit 2:I also tried this query to see if i can project the productId property in my query without including it in the where clause:
customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z))
and name == "Navigated to details view"
| top 101 by timestamp desc
| project timestamp, name, customDimensions, customDimensions.Properties.productId
但是此列为空:
我有什么想念的吗?工具是否存在问题并产生错误的查询?
Is there anything i am missing? Is the tooling a problem and producing a wrong query?
谢谢您的帮助！
推荐答案
您将必须使用mvexpand等各种运算符并进行扩展才能满足您的要求.请在下面的示例查询中找到.请注意，下面的示例只是一个示例查询，您可能需要进行一些调整才能使其按预期工作并获得预期的输出(例如，如果您期望在特定时间戳记下具有特定事件的customEvent的所有列的输出， productId等)
You would have to use various operators like mvexpand and extend to accomplish your requirement. Please find below sample query. Note that the below one is just a sample query which you may have to tweak a bit to make it work as expected and get the expected output (say if you are expecting output with all the columns of the customEvent at a particular timestamp which has particular productId, etc.)
customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z))
| top 101 by timestamp desc
| project timestamp, name, customDimensions_Properties
| where name == "Navigated to details view"
| extend CDP_toString=parsejson(tostring(customDimensions_Properties))
| mvexpand CDP_toString
| project CDP_toString
| where CDP_toString.['productId'] == "4711";
希望这会有所帮助！！干杯！！ :)
Hope this helps!! Cheers!! :)
这篇关于带WHERE子句的Azure Log Analytics查询不产生结果的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！