Logging in Azure function

Amar-Azure-Practice 661 Reputation points
2022-03-09T16:07:31.22+00:00

Hi,

I want to write log information to Azure LogAnalytics work space.
I can leverage the Ilogger to write log information from Azure Function to Log Analytics work space and i can query log data from Log anlalytics workspace querying so far it working fine.
we have a requirement to ingest the json objects to log analytics workspace.

log.LogError("json message", objectJSONLog);

using above statement i can ingest the custom json object to the logAnalytics workspace but when i am trying to query, i can query based on the filed in the Custom JSON object.

is there any where i can query log data based on the field from custom JSON object

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,414 questions
0 comments No comments
{count} votes

Accepted answer
  1. Sudipta Chakraborty - MSFT 1,101 Reputation points Microsoft Employee
    2022-03-09T18:37:18.483+00:00

    You can use KQL query to query a custom JSON field. You can use mv-expand or mv-apply along with parse_json to query the JSON object. The below example shows how to query a JSON object and a JSON Array.

    Sample Queries:

    //Query a JSON Object
    print input = '{"UserName":"Sudipta","LastName":"DName"}' //This is the JSON object
    | project UserName = parse_json(input).UserName
    
    //Query a JSON Array
    print input = '[{"UserName":"Sudipta","LastName":"DName"}]' //This is the JSON array
    | project UserName = parse_json(input)[0].UserName
    
    //Query a JSON Array using mv-apply
    print input = '[{"UserName":"Sudipta","LastName":"DName","Sid":"TheSID#"}]'
    | project parse_json(input)
    | mv-apply input on (
        project UserName = input.UserName
    )
    
    0 comments No comments

0 additional answers

Sort by: Most helpful