Kris Kross – Cross Resource querying in Log Analytics
To connect Application Insights with a Log Analytics workspace we had to use a solution from the gallery. This solution is now deprecated because with the new query language “Kusto” we are able to query resources not only across multiple Log Analytics workspaces, but also data from a specific Application Insights app in the same resource group, another resource group, or another subscription. This provides you with a system-wide view of your data.
workspace("<workspace>").<type> | <filters> | etc.
app("<appinsights>").<type> | <filters> | etc.
Because worspace and AppInsights names are not unique, you have different options to address the right resource.
By resourcename, the Log Analytics workspace name or appinsights name
workspace("la-vaslab").Update | count
By qualified name,
workspace('Microsoft Azure Enterprise/rg-loganalytics/la-vaslab').Update | count
By Workspace or AppInsights ID, the GUID of the resource
workspace('13fd3159-a232-4cdb-95ee-4f87fd4744ec').Update | count
Or by Azure Resource ID, format for workspaces:
format for apps:
workspace('/subscriptions/448907cf-8a32-4a4a-8fe4-9034eaba4850/resourcegroups/rg-loganalytics/providers/Microsoft.OperationalInsights/workspaces/la-vaslab').Update | count app('/subscriptions/448907cf-8a32-4a4a-8fe4-9034eaba4850/resourcegroups/rg-appinsights/providers/Microsoft.OperationalInsights/components/ai-vaslab').requests | count
With this cross resource querying ability it is possible to query and to join data from different resources.
Here is an example for a query across two workspaces:
union Update, workspace("la-vaslab").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update | where TimeGenerated >= ago(1h) | where UpdateState == "Needed" | summarize dcount(Computer) by Classification