Logging in Azure function

Question

Hi,

I want to write log information to Azure LogAnalytics work space.
I can leverage the Ilogger to write log information from Azure Function to Log Analytics work space and i can query log data from Log anlalytics workspace querying so far it working fine.
we have a requirement to ingest the json objects to log analytics workspace.

log.LogError("json message", objectJSONLog);

using above statement i can ingest the custom json object to the logAnalytics workspace but when i am trying to query, i can query based on the filed in the Custom JSON object.

is there any where i can query log data based on the field from custom JSON object

Answer 1

You can use KQL query to query a custom JSON field. You can use mv-expand or mv-apply along with parse_json to query the JSON object. The below example shows how to query a JSON object and a JSON Array.

Sample Queries:

//Query a JSON Object
print input = '{"UserName":"Sudipta","LastName":"DName"}' //This is the JSON object
| project UserName = parse_json(input).UserName

//Query a JSON Array
print input = '[{"UserName":"Sudipta","LastName":"DName"}]' //This is the JSON array
| project UserName = parse_json(input)[0].UserName

//Query a JSON Array using mv-apply
print input = '[{"UserName":"Sudipta","LastName":"DName","Sid":"TheSID#"}]'
| project parse_json(input)
| mv-apply input on (
    project UserName = input.UserName
)