join - 如何在 AppInsights 上使用 Kusto 查询语言进行内部联接

Question

我正在使用以下查询从使用 AppInsights 失败并返回 400 的请求中获取 operationId 值:

requests 
| project timestamp, id, operation_Name, success, resultCode, duration, operation_Id, cloud_RoleName, invocationId=customDimensions['InvocationId'] 
| where cloud_RoleName =~ 'xxxx' and operation_Name == 'createCase' and resultCode == 400 
| order by timestamp desc

我在以下查询中使用这些 operationId 值来获取所发生事件的日志:

traces
| union exceptions
| where operation_Id == '35edbc7c13f7ac4c85fa0b8071a12b72'
| order by timestamp asc

有了这个，我得到了我想要的信息，但我需要多次编写和执行查询，所以我试图在两个查询之间进行连接但没有成功，因为我不是查询 AppInsights 的专家，而且我'我不确定如何加入工会，你能帮我吗？

Answer 1

请尝试以下查询:

requests 
| project timestamp, id, operation_Name, success, resultCode, duration, operation_Id, cloud_RoleName, invocationId=customDimensions['InvocationId'] 
| where cloud_RoleName =~ 'xxxx' and operation_Name == 'createCase' and resultCode == 400 
| join (
    traces
    | union exceptions
) on operation_Id
| project-away operation_Id1
| order by timestamp asc

关于 join 运算符的更多详细信息 - https://learn.microsoft.com/en-us/azure/kusto/query/joinoperator