Search code examples
azureexceptionazure-application-insightskqlazure-monitoring

Azure Application Insights | KQL | Get exception details


We are using Azure application Insights for error logging. I am new to KQL and trying to fetch custom properties from inbuilt "customDimensions" column in the following format,

Data in "customDimensions" column

{
  "File Name":"Sample File 1",
  "Correlation ID":"e33a8d45-0566-4bf2-94f8-54a6fec29bff",
  "Error List":"[
      {
        "Function Name":"Sample Function 1",
        "Code":"#231256#"
      },
      {
        "Function Name":"Sample-Function-2",
        "Code":"#231258#"
      },
   ]"
}

Expected Output

File Name Correlation ID Function Name Code
Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample Function 1 #231256#
Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample-Function-2 #231258#

How can I achieve the above output using KQL?

Thank You.

Update: Adding a sample datatable

datatable(ErrorDetails:dynamic)
[
    dynamic({
        "File Name":"Sample File 1",
        "Correlation ID":"e33a8d45-0566-4bf2-94f8-54a6fec29bff",
        "Error List": [{
                "Function Name":"Sample Function 1",
                "Code":"#231256#"
            },
            {
                "Function Name":"Sample-Function-2",
                "Code":"#231258#"
            }
        ]
    })
]

Solution

  • mv-expand operator

    datatable(ErrorDetails:dynamic)
    [
        dynamic({
            "File Name":"Sample File 1",
            "Correlation ID":"e33a8d45-0566-4bf2-94f8-54a6fec29bff",
            "Error List": [{
                    "Function Name":"Sample Function 1",
                    "Code":"#231256#"
                },
                {
                    "Function Name":"Sample-Function-2",
                    "Code":"#231258#"
                }
            ]
        })
    ]
    | mv-expand EL = ErrorDetails.["Error List"]
    | project ["File Name"] = ErrorDetails["File Name"], ["Correlation ID"] = ErrorDetails["Correlation ID"], ["Function Name"] = EL["Function Name"], ["Code"] = EL["Code"]
    
    File Name Correlation ID Function Name Code
    Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample Function 1 #231256#
    Sample File 1 e33a8d45-0566-4bf2-94f8-54a6fec29bff Sample-Function-2 #231258#

    Fiddle