Search code examples
azure-application-insightsazure-data-explorerazure-log-analyticsazure-monitoring

Which API should be used for querying Application Insights trace logs?

Our ASP.NET Core app logs trace messages to App Insights. We need to be able to query them and filter by some customDimentions. However, I have found 3 APIs and am not sure which one to use:

  1. App Insights REST API
  2. Azure Log Analytics REST API
  3. Azure Data Explorer .NET SDK (Preview)

Firstly, I don't understand the relationships between these options. I thought that App Insights persisted its data to Log Analytics; but if that's the case I would expect to only be able to query through Log Analytics.

Regardless, I just need to know which is the best to use and I wish that documentation were clearer. My instinct says to use the App Insights API, since we only need data from App Insights and not from other sources.

Solution

  • The difference between #1 and #2 is mostly historical and converging.

    1. Application Insights existed as a product before log analytics, and were based on different underlying database technologies

    2. Both Application Insights and Log Analytics converged to use the same underlying database, based on ADX (Azure Data Explorer), and the same exact REST API service to query either. So while your #1 and #2 links are different, they point to effectively the same service backend by the same team, but the pathing/semantics are subtly different where the service looks depending on the inbound request.

    • both AI and LA introduce the concept of multi-tenancy and a specific set of tables/schema on top of their azure resources. They effectively hide the entire database from you, and make it look like one giant database.

    • there is now the possibility (suggested) to even have your Application Insights data placed in a Log Analytics Workspace:

      https://learn.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resource

      this lets you put the data for multiple AI applications/components into the SAME log analytics workspace, to simplify query across different apps, etc

    1. Think of ADX as any other kind of database offering. If you create an ADX cluster instance, you have to create database, manage schema, manage users, etc. AI and LA do all that for you. So in your question above, the third link to ADX SDK would be used to talk to an ADX cluster/database directly. I don't believe you can use it to directly talk to any AI/LA resources, but there are ways to enable an ADX cluster to query AI/LA data: