Search code examples
azure-monitoringazure-monitor-workbooks

Searching for {time} in a message template, without having the workbook parse it as a parameter


I want to create an azure monitor workbook that lets me search for specific message templates. Usually, these message templates contain placeholders. For example:

logger.LogInformation("Finished executing, took {time}ms", time);

Problem is though, if I include the placeholder in the query string for a workbook, it will fail since it considers the placeholder a parameter for the workbook. A very small example can be seen underneath.

AppTraces 
| where Properties.MessageTemplate == 'Finished executing, took {time}ms'

This will give me the following error message:

This query could not run because some parameters are not set.
Please set: time

I can't seem to figure out how to escape these characters, since this is not actually related to the kusto language, but more of an issue with the workbook. Can someone please advise?


Solution

  • Unfortunately, we don't (yet) have an escape sequence for parameters in workbooks.

    As a workaround, what you can do is split it up so workbooks doesn't detect it as a parameter, something like strcat('Finished executing, took {', 'time}ms'