带WHERE子句的Azure Log Analytics查询不产生结果 [英] Azure Log Analytics Query with WHERE clause produces no results

问题描述

我正在使用Azure Log Analytics查询源自AppCenter Diagnostics的Azure Application Insights中的日志条目. 在某些日志条目中，我使用自定义属性. 现在，我试图编写一个查询以仅显示具有给定值的某些属性的值.

I'm querying log entries in Azure Application Insights originating from AppCenter Diagnostics using Azure Log Analytics. In some log entries i use custom propertys. Now i'm trying to write a query to show values only with certain properties having a given value.

我的原始查询如下所示，并产生预期的结果:

My original query looks like this and produces the expected result:

customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z)) 
| top 101 by timestamp desc
| project timestamp, name, customDimensions.Properties
| where name == "Navigated to details view"

将鼠标悬停在"productId"属性上会显示一个加号，该加号允许添加过滤条件:

Hovering over the "productId" property shows a plus-sign which allows to add a filter criteria:

选择此选项扩展了我的查询范围:

Choosing this options extends my query:

customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z)) 
| top 101 by timestamp desc
| project timestamp, name, customDimensions.Properties
| where name == "Navigated to details view"
| where customDimensions_Properties.productId == 4711 

到目前为止，太好了.如果现在尝试运行此查询，则会收到消息找不到结果":

So far, so good. If i now try to run this query i get the message "NO RESULTS FOUND":

我还尝试将底部的where子句添加到第一个where子句

I also tried adding the where clause on the bottom to the first where clause

customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z)) 
and name == "Navigated to details view" 
and customDimensions.Properties.productId == 4711
| top 101 by timestamp desc
| project timestamp, name, customDimensions

很不幸，也没有结果.

我还尝试了此查询，以查看是否可以将查询中的productId属性投影到where子句中:

Edit 2: I also tried this query to see if i can project the productId property in my query without including it in the where clause:

customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z)) 
and name == "Navigated to details view" 
| top 101 by timestamp desc
| project timestamp, name, customDimensions, customDimensions.Properties.productId

但是此列为空:

我有什么想念的吗?工具是否存在问题并产生错误的查询?

Is there anything i am missing? Is the tooling a problem and producing a wrong query?

谢谢您的帮助！

推荐答案

您将必须使用mvexpand等各种运算符并进行扩展才能满足您的要求.请在下面的示例查询中找到.请注意，下面的示例只是一个示例查询，您可能需要进行一些调整才能使其按预期工作并获得预期的输出(例如，如果您期望在特定时间戳记下具有特定事件的customEvent的所有列的输出， productId等)

You would have to use various operators like mvexpand and extend to accomplish your requirement. Please find below sample query. Note that the below one is just a sample query which you may have to tweak a bit to make it work as expected and get the expected output (say if you are expecting output with all the columns of the customEvent at a particular timestamp which has particular productId, etc.)

customEvents
| where (timestamp >= datetime(2019-02-20T09:04:00.000Z) and timestamp <= datetime(2019-02-21T09:04:00.000Z)) 
| top 101 by timestamp desc
| project timestamp, name, customDimensions_Properties
| where name == "Navigated to details view"
| extend CDP_toString=parsejson(tostring(customDimensions_Properties))
| mvexpand CDP_toString
| project CDP_toString
| where CDP_toString.['productId'] == "4711";

希望这会有所帮助！！干杯！！ :)

Hope this helps!! Cheers!! :)

这篇关于带WHERE子句的Azure Log Analytics查询不产生结果的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！