This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi there,
I want to make a Query, on the Application Gateway and Front Door, shwoing 500 errors - but excluding 500 pages and certain pages/paths containing specific words.
Any good takes on how to do this?
Script that is being used on the AFD
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where isReceivedFromClient_b == true
| where toint(httpStatusCode_s) >= 500
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), StatusCode = httpStatusCode_s
| order by RequestCount desc
Thanks for help.
Hi @KE1980,
I think what you may be looking for is | where RequestUri_s !in('<not>'.'<this>','<word'>). See https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/inoperator for more info.
Regards,
Ryan
Hi @Ryan Hill
Sorry for the late reply, and thanks for your feedback
I have tried your sample, but just getting error: | where RequestUri_s !in('<not>'.'<this>','<Umbraco'>).
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where isReceivedFromClient_b == true
| where toint(httpStatusCode_s) >= 500
| extend ParsedUrl = parseurl(requestUri_s)
| where RequestUri_s !in('<not>'.'<this>','<Umbraco'>).
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), StatusCode = httpStatusCode_s
| order by RequestCount desc
Cheers
Hi @KE1980 ,
Apologies in getting back to this thread. Are you still experiencing the issue ? It might have been a typo when @Ryan Hill shared earlier, I have updated the script . Please see if the below script works for you and let us know if you have any further queries. Thank you.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where isReceivedFromClient_b == true
| where toint(httpStatusCode_s) >= 500
| where RequestUri_s !in('<not>','<this>','<Umbraco>')
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), StatusCode = httpStatusCode_s
| order by RequestCount desc
In addition @KE1980, '<not>','<this>','<word>' were simply place holders that should be replaced by the term(s) you want exclude. My apologies for the confusion. The error might have been caused by < > characters. If you want to omit Umbraco, it would be
| where RequestUri_s !in('/Umbarco').
The / preceeding Umbarco is there because RequestUri is the relative path of the request. If Umbarco is in various places of the relative path, then consider using | where RequestUri_s !contains('Umbarco').
Regards,
Ryan
@KE1980, Checking in to see if you had a chance to review the above information and have any further queries. Thanks
Hi @Ryan Hill and @bharathn-msft
Thanks for you feedback.
I will give it a GO, see if I can get to work / get the desired result and get back to you with a status.
I will give it a GO, see if I can get to work / get the desired result and get back to you with a status.
Thank you @KE1980 for your response , looking forward to hear back from you.
Hi again,
I`m getting the following error when running the script. Have been trying to modifie it, but no luck with that.
@KE1980 Checking in to see if you able to try the edit @Ryan Hill suggested and see it works for your scenario and have any further queries. Thank you