如何使用 Kusto 查询语言在 Azure 日志中显示具有多个自定义指标的时间表

Question

I have the following Logs in Azure Logs:

The query for the above is as follows:

The output is shown below appearing like a 'scatter diagram' but I am looking for a timechart - like connecting the dots but failed to do so:

How do I join the dots or is there a limitation or the way the KQL above (Kusto Query Language) is written?

Answer 1

It is your KQL query that has to be modified. The key to getting your time-series charts right is to fetch all the time and metric information in the result set from your query.

Remember that when constructing a timechart, the first column is the x-axis, and should be datetime. Other (numeric) columns are y-axes. There is one string column whose values are used to "group" the numeric columns and create different lines in the chart (further string columns are ignored).

Considering the requests table as an example (you can apply it to your customEvents data as appropriate), multiple metrics can be plotted as:

# Time-series chart with multiple metrics
requests
| summarize Requests = count(), Users = dcount(user_Id) by bin(timestamp, 1h)
| render timechart

Output:

The query control uses timestamp for the X-axis and Requests & Users as separate series on the Y-axis here.