Skip to main content

Log Queries for Tenant & CorrelationId Tracing – KQL Queries

This document provides sample KQL queries to fetch logs from Application Insights for a specific TenantId and correlationId. This is useful to trace a full request flow from API to messaging services to service hosts, end-to-end.

Note:
The Application Insights log queries in this section are applicable to deployments where Azure Application Insights is enabled (typically Azure-hosted environments).

❗Important​

  • Use exceptions table for error logs.
  • Use traces table for diagnostic/logging traces.
  • Use customDimensions.correlationId to trace a single request across systems.
  • Always filter on TenantId for multi-tenant applications.

📑 Sample Queries​

📌 1. Trace logs for a specific TenantId and correlationId​

traces
| where isnotempty(customDimensions.TenantId)
  and isnotempty(customDimensions.correlationId)
  and customDimensions.TenantId == "<YourTenantId>"
  and customDimensions.correlationId == "<YourCorrelationId>"
| order by timestamp asc

📌 2. Exception logs for a specific TenantId and correlationId​

exceptions
| where isnotempty(customDimensions.TenantId)
  and isnotempty(customDimensions.correlationId)
  and customDimensions.TenantId == "<YourTenantId>"
  and customDimensions.correlationId == "<YourCorrelationId>"
| order by timestamp asc

📌 3. Combined logs (traces + exceptions) for a specific TenantId and correlationId​

union traces, exceptions
| where isnotempty(customDimensions.TenantId)
  and isnotempty(customDimensions.correlationId)
  and customDimensions.TenantId == "<YourTenantId>"
  and customDimensions.correlationId == "<YourCorrelationId>"
| project timestamp, message, outerMessage, customDimensions, operation_Name, itemType

Example Queries​

✅ Example 1 — Trace Logs​

traces
| where customDimensions.TenantId == "11"
  and customDimensions.correlationId == "c29f76ca-f583-4e48-8fa9-72a4a9e037de"
| order by timestamp asc

✅ Example 2 — Exception Logs​

exceptions
| where customDimensions.TenantId == "11"
  and customDimensions.correlationId == "c29f76ca-f583-4e48-8fa9-72a4a9e037de"
| order by timestamp asc

✅ Example 3 — Union of Trace and Exception Logs​

union traces, exceptions
| where customDimensions.TenantId == "11"
  and customDimensions.correlationId == "c29f76ca-f583-4e48-8fa9-72a4a9e037de"
| project timestamp, message, outerMessage, itemType

📌 Notes​

  • Replace <YourTenantId> with the actual client tenant ID (e.g., '73').
  • Replace <YourCorrelationId> with the request’s correlationId to trace its full path.
  • You can further filter or extend the queries by operation_Name, cloud_RoleName, or other customDimensions fields.
  • Logs are sorted by timestamp to view them chronologically.