How to use Kusto to access Azure Function app code logging() message?

Question

I have a Python Azure Function that has a bunch of Python logging.error()/logging.info() messages. I like this approach (I'm fairly new to Python) as I can look at the run history and see key pieces of information about a run.

Azure Function run history looks like this:

Example1:

This Kusto query gets me the basics about a given run, but none of the specifics

requests
| project timestamp, id, operation_Name, success, resultCode, duration, operation_Id, cloud_RoleName, invocationId=customDimensions['InvocationId']
| where timestamp > ago(6d)
| where cloud_RoleName =~ 'functionAppName' and operation_Name =~ 'functionName'
| order by timestamp asc

Output:

Example2:

This query gets me all the details I need, but I have to define the operation_id and InvocationId

union traces
| union exceptions
| where timestamp > ago(30d)
| where operation_Id == '<biglongstring>'
| where customDimensions['InvocationId'] == '<biglongstring1>'
| order by timestamp asc
| project timestamp, message = iff(message != '', message, iff(innermostMessage != '', innermostMessage, customDimensions.['prop__{OriginalFormat}'])), logLevel = customDimensions.['LogLevel']

Output:

I need to query specific keywords found in these logging() messages.

How do I do this with a Kusto query?

Answer 1

You can use any of the string search operators , such as "has". If your logging message follows a certain convention you can use the parse operator to extract the relevant data into columns.

Answer 2

Below is what ended up working for me.

| where message contains "specific string in logging" | where message contains "specific string in logging" was the key. Here message has the logging string I was looking for.

union traces
| union exceptions
| where timestamp > ago(30d)
| where message contains "specific string in logging"
| order by timestamp asc
| project timestamp, message = iff(message != '', message, iff(innermostMessage != '', innermostMessage, customDimensions.['prop__{OriginalFormat}'])), logLevel = customDimensions.['LogLevel']