azurehttprequestkqlazure-log-analyticsazure-monitoring

Monitor HTTP traffic for Azure Web App using Log analitics and KQL query


I have a Azure Web Application in Azure. I have one endpoint : https://dev-my-app.azurewebsites.net/test I would like to see all http requests which were done for this endpoint. I have read that I can use Log Analitics Workspace (https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview) in order to achieve it. I have configured a workspace. I have also created Diagnostic setting which sends "HTTP logs" to the workspace :

enter image description here After I go to the "Logs" and try to run the query

// Client requests per hour 
// Count of client requests hourly. 
AGCAccessLogs
| summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
| render timechart

enter image description here I am getting a response:

'summarize' operator: Failed to resolve table or column expression named 'AGCAccessLogs' Request id: 1449b704-70bb-4d84-8c00-0d5b086fa637

It looks like AGCAccessLogs table does not exist in my log analitics worskpace.

I have also tried to call this query directly from log analytics workspace: enter image description here

What am I missing in order to make this query work? Is there other way to see the http traffic for my web app?


Solution

  • Follow the below steps to run the query in Logs.

    AGCAccessLogs
    | summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
    | render timechart
    

    enter image description here

    enter image description here

    enter image description here

    Workaround 1:

    To fetch the Http Logs of your web app, run AppServiceHTTPLogs query:

    enter image description here

    Workaround 2:

    Configure Application Insights for your web app. Navigate to Azure Web App=> Settings=> Application Insights=> Logs and run the below query to fetch the Http logs:

    requests
    | where resultCode == 200
    

    enter image description here