I'm trying to create a custom log alert with this query:
traces
| where message contains "Setup"
| extend Proposal = tostring(split(split(tostring(message), " ]")[1], ": ")[1])
| summarize AggregatedValue=count() by Time=bin(ago(24h), 1h), Proposal
But I'm getting the error
Search Query should contain 'AggregatedValue' and 'bin(timestamp,
[roundTo])' for Metric alert type
Since I have both requirements of the error, why am I getting it?
Hello and welcome to Stack Overflow!
I tried a similar log query with the same constructs and was able to create a custom log alert successfully. This could be a one-off issue. I'd suggest you to give it another try and see if the error recurs. Else you could also try creating it via other alternate options like ARM templates, Powershell, CLI or REST APIs, as detailed in this doc.
Related
I was getting some exceptions around 60 exceptions when I run my .NET Core Application - of a particular type - Partner center exceptions.
I have dealt with those exceptions but now I am writing some KQL queries so that I come to know if anything goes wrong beforehand.
I want to write KQL query which in future catches exceptions from partner center but not that type of exception - so how to filter them out?
My Query looks like -
traces
| where customDimensions.LogLevel == "Error"
| where operation_Name == "functionName"
| where iKey != "************"
I saw this iKey - what is it? and how can I write a desired query is what I need to know.
Also :
Could not find purchase charge for customer and "errorName":"RelationshipDoesNotExist" ----> this all comes in message and also customDimensions field
Can I extract this errorName and exclude these type of exceptions? Any way to do that?
For now I have used :
where message !contains_cs "Could not find purchase charge for customer"
but it has high compute price, so looking for an alternate to optimize the query.
iKey correspondents to the instrumentation key:
When you set up Application Insights monitoring for your web app, you create an Application Insights resource in Microsoft Azure. You open this resource in the Azure portal in order to see and analyze the telemetry collected from your app. The resource is identified by an instrumentation key (ikey). When you install the Application Insights package to monitor your app, you configure it with the instrumentation key, so that it knows where to send the telemetry.
(source)
I want to write KQL query which in future catches exceptions from partner center but not that type of exception - so how to filter them out?
Exceptions are stored in the exceptions table. You can filter them based on a known property like the exception type. For example, say you want all exceptions except those of type NullReferenceException you can do something like this:
exceptions
| where ['type'] != "System.NullReferenceException"
My C# code is log.BeginScope("Testing Scope1"); and log.BeginScope("Testing Scope2");. How can I use in Azure Application Insights (in https://portal.azure.com)?
If your code like below:
using (_logger.BeginScope("Testing Scope1"))
{
_logger.LogInformation("this is an info from index page 111111");
}
Then, after the code is executed, nav to azure portal -> your application insights -> Logs -> in the traces table, write the following query(also note that select a proper "time range"):
traces
| where customDimensions.Scope contains "Testing Scope1"
| project message, customDimensions
The screenshot is as below:
By the way, it may take a few minutes for the logs being generated. And please also set the proper log level in your application(like set the proper log level in your azure function).
I want to search Application Insights logs by messages inside. For example, I have the following log:
I want to search all calls, when message: 'FunctionCallEfsApi no messages' consists...
How can I do it?
If you are looking inside traces or exceptions inside Application Insights, you can use following query to get all messages when message contains : 'FunctionCallEfsApi no messages'
traces | where message contains "FunctionCallEfsApi no messages"
You can navigate to Logs(Analytics) on Application Insights resource you have and write a query to fetch those information,
traces
| where message contains "FunctionCallEfsApi no messages"
I'm using Azure Logic App. This is the architecture:
I have a Scope Insert Row that include an insert statement in database.
I would like to send via mail the message of the exception of the insertion.
For example if the Insert statement failed with Foreign key exception, i would like to send this message.
How can I refer to this error message inside the 'Send error Msg' feature?
Thanks a lot guys :)
You could set the Configure run after value to implement it. Set the Send an email action run after Insert row has failed.
If the Insert action success, the send mail won't execute and if it fails the send mail would work. You could also add the run after action value like the time out or is skipped, they are all kind of exceptions.
UPDATE: If this is your error message, you could add it with #{body('Insert_row')?['message']} in code view mode.
And here is my error message and the subject setting.
You can make use of Filter Array and result function to capture the actual error of an action failed in a Scope.
For more insights with example see following article - How can I handle exception in Azure Logic App
Thanks,
Maheshkumar Tiwari
TechFindings...by Maheshkumar Tiwari
I have made some small changes to an Azure ARM template file and now when I try to deploy or validate via the xplat cli I get this message.
error: InvalidTemplateDeployment : The template deployment
'fakedDeploymentName' is not valid according to the validation
procedure. The tracking id is '\some kind of GUID here\'.
See inner errors for details. Please see http://aka.ms/arm-deploy for
usage details.
error: PreflightValidationCheckFailed : Preflight
validation failed. Please refer to the details for the specific
errors.
I would love to troubleshoot this problem, but I don't see any "inner errors" on the console. It even gives me a unique GUID each time, implying that I could use this GUID to look up a more informative message. Where can I view a more detailed error? (not looking for help on the real source of the error yet)
Log into the azure portal portal.azure.com.
Open the Activity log
Find the record with Operation Name of Validate in the list of activities. It should have a red exclamation mark because it failed.
Click on it that record. Then click on the JSON tab at the bottom. Get reading and somewhere deep down in returned Json you might find an error in the statusMessage such as "The storage account named helloworld is already taken."
Make sure you're running the latest version of the CLI, we're working on bubbling up the detailed error. If that's still not catching it, let us know https://github.com/Azure/azure-xplat-cli/issues
Then if the log isn't showing you the detail, run the deployment with the -vv switch, the detailed debug output (while verbose) will have all the error messages and you can usually sift through and find the specific failure.
azure group deployment create ... --debug
Powershell:
New-AzResourceGroupDeployment ... -debug
Run the following PowerShell Azure cmdlet with the tracking ID supplied:
Get-AzureRMLog -CorrelationId xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -DetailedOutput
Building on nftw's answer...
To make it faster/easier to find the error issue I used grep and less with a variable as follows:
$correlationId ='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' # store your correlation ID here
Get-AzureRmLog -CorrelationId $correlationID -DetailedOutput | grep -C 10 $correlationID | less
In my testing the error was close to the top of the output. You could use less and the forward-slash key / and search "error" to find the error even quicker.
I believe that tracking ID is for technical support for looking at their logs, not for the user.
Regarding your exact question, you need to take a look at logs - reference.
Another good way to validate the template is to use Resource Explorer.
Building on #nftw:
$deploymentGroupName = 'deploymentGroupName'
$correlationId = ((Get-AzureRMLog -ResourceGroup $deploymentGroupName)[0]).CorrelationId
$logentry = (Get-AzureRMLog -CorrelationId $correlationId -DetailedOutput)
#$logentry
$rawStatusMessage = $logentry.Properties
$status = $rawStatusMessage.Content.statusMessage | ConvertFrom-Json
$status.error.details
$status.error.details.details
I was running in the same issue. Basically, I couldn't get any details passed "InvalidTemplateDeployment".
I added my ARM template in a Visual Studio: Azure Resource Group project template and tried to deploy it. I got verbose details in the Output tab. That helped me solve my problem.
In my case it was the name of the cluster, it can only be small letters and numbers.
az vm list [--only-show-errors]
[--resource-group]
[--show-details]
[--subscription]