Azure Log Analytics严重程度为字符串

Question

当前，在Azure应用程序洞察中，我们在严重性的严重性级别的数量下看到，而不是信息，错误，...是否可以将严重性显示为字符串。

"Serilog": {
"Using": [
    "Serilog.Sinks.ApplicationInsights"
],
"MinimumLevel": {
    "Default": "Debug",
    "Override": {
        "Microsoft": "Information"
    }
},
"WriteTo": [
    {
        "Name": "ApplicationInsights",
        "Args": {
            "restrictedToMinimumLevel": "Information",
            "telemetryConverter": "Serilog.Sinks.ApplicationInsights.Sinks.ApplicationInsights.TelemetryConverters.TraceTelemetryConverter, Serilog.Sinks.ApplicationInsights",
            "instrumentationKey": "key"
        }
    }
],
"Enrich": [
    "FromLogContext"
],
"Properties": {
    "Application": "Sample"
}
}

Answer 1

Ad hoc function, using

// Sample generation. Not part of the solution
let traces = materialize(range i from 1 to 10 step 1 | project severityLevel = toint(rand(5)), Timestamp = ago(rand()*1d));
// Solution starts here
let getSeverityDescription = (severityLevel:int)
{
    dynamic(["Verbose", "Information", "Warning", "Error", "Critical"])[severityLevel]
};
traces
| extend SeverityDescription = getSeverityDescription(severityLevel)

SeverityLevel	Timestamp	SpeyityDescription
3	2022-06-29T11：56：56：56	3936027Z错误
“ noreferrer	：56：	20UZ3VQT1BOCR7TPPMC2PWDUDAN6KMBAAA =“ rel =
4	2022-06-29 TRICEN 2 :29.1658275Z	Critical
1	2022-06-30T03:29:22.4724933Z	Information
0	2022-06-30T04:01:15.7748102Z	Verbose
0	2022-06-30T04:37:39.740977Z	Verbose
2	2022-06-30T05:13:04.734582 Z	警告
2	2022-06-30T07：32：01.9569582Z	警告
2	2022-06-06-30T07：41：46.3364296Z	警告
1	2022-06-06-06-30T09：42：42：42：	信息

22.5852665Z .com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA22QMU/DQAyF90j5D0%20ZcqgiZGABdQIGJMRSBEPV4Uic9NDlLvIZRKH8d5y2S6R6sa1nP39yVWFlh9ETegrEVlwMl3iOgtGyIHaQLSFF/zkpeeZJIGwbSlhisELsrHc/VLINPcGh4zighkTUV0hCozZ7jBw/qBEk%20tIN2T1p9uog0QWZdtvy2pgFXtxASRRINdvHo2Iu6taY2zyrFPZEotbKl7AlpiNVT7I6ud9TatiNh7klytnRGz1o8uw3z6DR7oIdXFOui1fi95ioWKB4DF3k4fCKqX2zHFzop/KBOfJU3Kmfa6wvNmY9s9/k2Z%20SHl%20UZ3vQt1BocR7tPPMc2PwDUdan6KMBAAA=" rel="noreferrer">Fiddle

Answer 2

严重程度是枚举，请参阅文档：

关键4
关键的严重程度。

错误3
误差严重程度。

信息1
信息严重程度。

冗长0
冗长的严重程度。

警告2
警告严重程度。

我们可以使用它来创建一个kusto查询：

let severities = datatable(severityLevel:int, severity:string)
[
   0, "Verbose",
   1, "Information",
   2, "Warning",
   3, "Error",
   4, "Critical",
];
traces
| join severities on severityLevel
| project timestamp, message, severity

Answer 3

保持简单。

traces
| extend SeverityLevel = case(severityLevel == 1, "Information",severityLevel == 2, "Warning",severityLevel == 3, "Error", tostring(severityLevel)), FromDate=ago(30d) 
| where (timestamp >= FromDate)