azurehttprequestkqlazure-log-analyticsazure-monitoring

Monitor HTTP traffic for Azure Web App using Log analytics and KQL query

I have a Azure Web Application in Azure. I have one endpoint : https://dev-my-app.azurewebsites.net/test

I would like to see all http requests which were done for this endpoint. I have read that I can use Log Analytics Workspace (https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview) in order to achieve it.

I have configured a workspace. I have also created Diagnostic setting which sends "HTTP logs" to the workspace :

enter image description here

After I go to the "Logs" and try to run the query

// Client requests per hour 
// Count of client requests hourly. 
AGCAccessLogs
| summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
| render timechart

enter image description here

I am getting an error as response:

'summarize' operator: Failed to resolve table or column expression named 'AGCAccessLogs'
Request id: 1449b704-70bb-4d84-8c00-0d5b086fa637

It looks like AGCAccessLogs table does not exist in my log analytics workspace.

I have also tried to call this query directly from log analytics workspace:

enter image description here

What am I missing in order to make this query work? Is there other way to see the http traffic for my web app?

Solution

  • Follow the below steps to run the query in Logs.

    AGCAccessLogs
| summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
| render timechart

    enter image description here

    enter image description here

    enter image description here

    Workaround 1:

    To fetch the Http Logs of your web app, run AppServiceHTTPLogs query:

    enter image description here

    Workaround 2:

    Configure Application Insights for your web app. Navigate to Azure Web App=> Settings=> Application Insights=> Logs and run the below query to fetch the Http logs:

    requests
| where resultCode == 200

    enter image description here