How can I tell which of my Azure Application Insights data are billable without running excessively large and expensive multi-table queries?

Question

I am trying to analyze my usage of Azure Application Insights and figure out where I am spending money.

I am reading this article: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#_isbillable

The article gives some examples of KQL (Kusto) queries that I can run in order to get an overview of billable data, such as this:

union withsource = tt * 
| where _IsBillable == true 
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != ""
| summarize TotalVolumeBytes=sum(_BilledSize) by computerName

The article also says:

Use queries with union withsource = tt * sparingly as scans across data types are expensive to execute.

In other words, the article cautions against using the query examples verbatim lest I waste money scanning data that I don't need.

As far as I understand, withsource = tt * is a union/join of multiple tables. Can I check where the important columns like IsBillable are actually located so that I can join just those tables I actually need?

Answer 1

I figured it out. There are examples here: https://learn.microsoft.com/en-us/azure/azure-monitor/app/pricing

This assumes that you are using Workspace-based Application Insights: https://learn.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resource

1. In the Azure Portal, you need to go to your Log Analytics workspace, NOT your Application Insights resource.
2. In the left-hand menu, select Logs.
3. Write a query to search one of the tables, e.g. AppRequests.
4. The tables _IsBillable_ and _BilledSize are hidden. The autocompletion will not suggest them, and the syntax highlighting will underline them and tell you they don't exist, but when you actually run your query the columns work fine. For example:

AppRequests
| take 10
| project TimeGenerated, Name, DurationMs, _BilledSize, _IsBillable