App Service Diagnostic Settings : documentation about generated json files

Question

App Service Diagnostic Settings : documentation about generated json files

fhtino 166

I have activated Diagnostic Settings export to Storage Account on an Azure App Service. It creates many json files. 1 per hour in my understanding.
Where can I find the documentation about the fields of these json files? Also, the details inside "properties" field. It looks like a W3C standard log file but I would like to find official documentation.

PS: discussione started on Twitter with AzureSupport: https://twitter.com/fhtino/status/1601819511677648896

1 answer

Your answer

Answer 1

SwathiDhanwada-MSFT 18,996 Moderator

@fhtino The diagnostic logs sent from App service can be stored in log analytics workspace in two formats. One is the logs can be sent to Azure Diagnostics or to individual table.

AzureDiagnostics : The resource log for each Azure service has a unique set of columns. The AzureDiagnostics table includes the most common columns used by Azure services. If a resource log includes a column that doesn't already exist in the AzureDiagnostics table, that column is added the first time that data is collected.
- If the logs are sent to AzureDiagnostic Table, the log format is as per this document and all the properties of log shown here will be in properties column of AzureDiagnostics table.
Resource specific table: In this mode, Individual tables in the selected workspace are created for each category selected in the diagnostic setting.
- If it is sent to individual table, the properties shown here will be logged as columns.

fhtino 166 Reputation points

2022-12-12T20:56:15.667+00:00

@SwathiDhanwada-MSFT I'm exporting to Storage Account and not to Log Analytics.
As I wrote, I see json files created evert hours. I need the list of fields and their meaning of the json file. (please, look at my screenshot)
Some fields seem to be defined here but nor all: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs-schema
E.g. EventTime, Host and others are not defined.
Documentation would clarify a lot of doubts, like what is the difference between "time" and "EventTime"?

For fields inside Properties, the list could be this: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/appservicehttplogs

Coming back to json file. In my case I see files "PT1H.json" in folder with path like this:
resourceId=/SUBSCRIPTIONS/******/RESOURCEGROUPS/******/PROVIDERS/MICROSOFT.WEB/SITES/*****/y=2022/m=12/d=11/h=05/m=00/PT1H.json
Is this structure documented? Could it change? Is there always one PT1H.json file every hour?

I need to write a program to read this files and collect information. So I need to be sure about file/folders structure, file name, and what I can find inside json files.
SwathiDhanwada-MSFT 18,996 Reputation points Moderator

2022-12-14T11:41:28.483+00:00
@fhtino You are indeed right. I couldn't find information about the highlighted properties for resource logs. I have raised GitHub issue for the same for content author to update the entire schema.

Regarding PT1H.json files, the logs sent to storage account are stored in blobs within the container which use the following naming convention:

insights-logs-{log category name}/resourceId=/SUBSCRIPTIONS/{subscription ID}/RESOURCEGROUPS/{resource group name}/PROVIDERS/{resource provider name}/{resource type}/{resource name}/y={four-digit numeric year}/m={two-digit numeric month}/d={two-digit numeric day}/h={two-digit 24-hour clock hour}/m=00/PT1H.json

Each PT1H.json blob contains a JSON object with events from log files that were received during the hour specified in the blob URL. During the present hour, events are appended to the PT1H.json file as they are received, regardless of when they were generated. The minute value in the URL, m=00 is always 00 as blobs are created on a per hour basis.

Reference Documents:

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs#send-to-azure-storage

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs-blob-format

Share via

App Service Diagnostic Settings : documentation about generated json files

1 answer

Your answer