azure-application-insightskqlazure-monitor-workbooks

Kusto - render timechart with trend line over a dataset already having an aggregation column


I have a function that fetches the total number (let's call this column 'messageCount') of dead-letter messages per each topic/subscription and creates a new record in traces table, every day.

What I want to achieve is to render a timechart for my workbook, that will show me in the last 7 days the trend/evolution per each topic/subscription, considering the aggregation column above ('messageCount') and also, if possible, a trend line.

On top of what, I want to make use of the hover effect based on my 'messageCount' column that within App Insights Logs it shows the value whereas in the Workbook it does not.

What I've tried so far:

traces
| where timestamp > ago(7d)
| extend
    TopicName = tostring(customDimensions["prop__TopicName"]), 
    SubscriptionName = tostring(customDimensions["prop__SubscriptionName"]),
    MessageCount = toint(customDimensions["prop__DlqCount"]),
    ["Topic/subscription"] = strcat(tostring(customDimensions["prop__TopicName"]), '/', tostring(customDimensions["prop__SubscriptionName"]))
| where cloud_RoleName startswith "myCloudName" and message has "customString"
| make-series take_any(MessageCount) on timestamp in range (ago(7d), now(), 1d) by SubscriptionName
| render timechart 

The above query works fine in the query logs of Insights however it does not have the same behavior in the workbook. Any hints/tips? Thanks

A sample returned by the regular query without the make-series operator

timestamp  | topicName | subscriptionName | messageCount
--------------------------------------------------------
10/31/2022 | myTopic1  | mysubscription1  |   915
10/31/2022 | myTopic2  | mysubscription2  |   1023
10/31/2022 | myTopic3  | mysubscription3  |   602
10/30/2022 | myTopic1  | mysubscription1  |   927
10/30/2022 | myTopic2  | mysubscription2  |   1029
10/30/2022 | myTopic3  | mysubscription3  |   608

Edit - hover effect in logs compared to workbook

Insights logs - enter image description here

Workbook - enter image description here


Solution

  • What I want to achieve is to render a timechart for my workbook, that will show me in the last 7 days the trend/evolution per each topic/subscription, considering the aggregation column above ('messageCount') and also, if possible, a trend line.

    1. workbooks only supports splitting up of series based on one field (you can customize x, y, and series columns)

      to get a series line in workbooks for each topic+subscription, you'd have to return that combination of fields as one value column, using something like by strcat( subscriptionName, " - ", topicName )

    2. workbooks does not currently have a way to calculate a trend line from the data.
      Others have created this by running 2 queries on the same data, 1 that calculates individual series data, and another that calculates the trend line, and then using union to combine those 2 things into one result. You can then use chart settings -> series settings to customize the label and color of the calculated trend line

      Doing this in a union query also lets the query work inside logs view outside of workbooks as well.

    On top of what, I want to make use of the hover effect based on my 'messageCount' column that within App Insights Logs it shows the value whereas in the Workbook it does not.

    Unfortunately, the charting framework that workbooks is currently built on top of does not have tooltips, it only has the hover behavior where the hovered value appears in the bottom "metrics" area. The logs team built their experiences on a different framework that has different styles and behaviors of legends/hover/etc.

    The various teams (portal, logs, workbooks) are working on converging towards similar frameworks but that work is long term and not as simple as we'd like.