如何在AppInsights上使用Kusto查询语言进行内部联接

Question

我正在使用以下查询从使用AppInsights失败400的请求中获取operationId值：

requests 
| project timestamp, id, operation_Name, success, resultCode, duration, operation_Id, cloud_RoleName, invocationId=customDimensions['InvocationId'] 
| where cloud_RoleName =~ 'xxxx' and operation_Name == 'createCase' and resultCode == 400 
| order by timestamp desc

我在以下查询中使用这些operationId值来获取发生的情况的日志：

traces
| union exceptions
| where operation_Id == '35edbc7c13f7ac4c85fa0b8071a12b72'
| order by timestamp asc

有了这个，我得到了我想要的信息，但是我需要多次编写和执行查询，所以我试图在两个查询之间进行连接而没有成功，因为我不是AppInsights的查询专家，我不确定如何加入工会，您能帮我吗？

Answer 1

请尝试以下查询：

requests 
| project timestamp, id, operation_Name, success, resultCode, duration, operation_Id, cloud_RoleName, invocationId=customDimensions['InvocationId'] 
| where cloud_RoleName =~ 'xxxx' and operation_Name == 'createCase' and resultCode == 400 
| join (
    traces
    | union exceptions
) on operation_Id
| project-away operation_Id1
| order by timestamp asc

有关join运算符-https://docs.microsoft.com/en-us/azure/kusto/query/joinoperator

的更多详细信息