Skip to main content

Log Queries for Trace, Exception, and Combined Logs by Tenant – KQL Queries

This document provides Kusto Query Language (KQL) examples for fetching logs from Azure Application Insights, specifically focusing on trace logs, exception logs, and the union of both. The queries are filtered based on tenant ID and specific request characteristics to differentiate API, Service Host, and Messaging logs.

Note:
The Application Insights log queries in this section are applicable to deployments where Azure Application Insights is enabled (typically Azure-hosted environments).

API Logs​

Fetch logs for API requests filtered by TenantId and request path containing /api/v1.0.

Trace Logs (API)​

traces
| where isnotempty(customDimensions.TenantId)
    and tostring(customDimensions.TenantId) == '<YourTenantId>'
    and isnotempty(customDimensions.requestPath)
    and tostring(customDimensions.requestPath) has "/api/v1.0"
| order by timestamp asc

Exception Logs (API)​

exceptions
| where isnotempty(customDimensions.TenantId)
    and tostring(customDimensions.TenantId) == '<YourTenantId>'
    and isnotempty(customDimensions.requestPath)
    and tostring(customDimensions.requestPath) has "/api/v1.0"
| order by timestamp asc

Union of Trace and Exception Logs (API)​

union traces, exceptions
| where isnotempty(customDimensions.TenantId)
    and tostring(customDimensions.TenantId) == '<YourTenantId>'
    and isnotempty(customDimensions.requestPath)
    and tostring(customDimensions.requestPath) has "/api/v1.0"
| order by timestamp asc

Service Host Logs​

Fetch logs for Service Host requests filtered by TenantId and request path containing GRPC.

Trace Logs (Service Host)​

traces
| where isnotempty(customDimensions.TenantId)
    and tostring(customDimensions.TenantId) == '<YourTenantId>'
    and isnotempty(customDimensions.requestPath)
    and tostring(customDimensions.requestPath) has "GRPC"
| order by timestamp asc

Exception Logs (Service Host)​

exceptions
| where isnotempty(customDimensions.TenantId)
    and tostring(customDimensions.TenantId) == '<YourTenantId>'
    and isnotempty(customDimensions.requestPath)
    and tostring(customDimensions.requestPath) has "GRPC"
| order by timestamp asc

Union of Trace and Exception Logs (Service Host)​

union traces, exceptions
| where isnotempty(customDimensions.TenantId)
    and tostring(customDimensions.TenantId) == '<YourTenantId>'
    and isnotempty(customDimensions.requestPath)
    and tostring(customDimensions.requestPath) has "GRPC"
| order by timestamp asc

Messaging Logs​

Fetch messaging logs where requestPath is empty, and pod_name is present. No tenant filter is required.

Trace Logs (Messaging)​

traces
| where isempty(customDimensions.requestPath)
    and isnotempty(customDimensions.pod_name)
| order by timestamp asc

Exception Logs (Messaging)​

exceptions
| where isempty(customDimensions.requestPath)
    and isnotempty(customDimensions.pod_name)
| order by timestamp asc

Union of Trace and Exception Logs (Messaging)​

union traces, exceptions
| where isempty(customDimensions.requestPath)
    and isnotempty(customDimensions.pod_name)
| order by timestamp asc

📌 Notes​

  • Replace <YourTenantId> with the actual client tenant ID (e.g., '73').
  • The union queries combine both trace and exception logs to provide a holistic view.
  • The queries order results ascending by timestamp to track log events over time.
  • Filtering conditions ensure logs are scoped appropriately by tenant and log type.