Accessing Application Insights data with Lokqldx

Lokqldx can issue KQL queries to ApplicationInsights resources and render the results locally using the .appinsights command

.set resource /subscriptions/3f57a...

.appinsights $resource 14d
exceptions
| summarize count() by bin(timestamp,1d)
| render columnchart

command format

.appinsights requires two parameters and must be followed by the query to issue to the resource

• Rid. This is the resource id of the application-insights resource
• Timeframe. This is the time-range for the query. The parameter may be specified using KQL syntax, i.e. "14d" for 2 weeks or "6h" for 6 hours.

Obtaining resource-ids

Resource-ids can be obtained by navigating to the application-insights resource in the Azure portal. Go to the "Overview" blade and then click on "JSON View" (at top right). The Resource ID can be copied from the displayed JSON.

Since resource-ids are long and unwieldy, it's usually more convenient to use the .set command to save these to a variable as in the example above. You can set these variables in the Workspace or Application startup scripts (see Preferences) for easier reuse.

Prompting for table and column names

The editor is preloaded with application-insight table and column names.

• Pressing '[' in the block immediately after a .appinsights command will display the list of known tables.
• Once a table has been entered, pressing '@' will display a list of columns appropriate for that table.

Rendering

There is currently a mismatch between the way that application-insights and lokqldx interpret column order to create charts. For simple charts this is unlikely to cause problems but if results do not render correctly locally you may need to project columns in a specific order. Lokqldx uses the following convention:

• first column is mapped to the X axis
• second column is mapped to the Y axis
• third column (if present) is used as the key/series-identifier

Lokqldx is capable of rendering more chart types than application insights. For example, lokqldx can render results as a linechart. The easiest way to accomplish this is to:

• issue the appinsights query without a render operator
• .materialize the result into a local table
• query the local table with a render operation to get the desired visualisation.