How to query my Application Insights Logs (Analytics) from Kusto.Explorer?

Question

Update July 13, 2021

The links used below are now partially obsolete. Here is the new section on language differences.

Original post

On Azure Portal, in my App Insights / Logs view, I can query the app data like this:

app('my-app-name').traces

The app function is described in the article app() expression in Azure Monitor query.

Kusto.Explorer doesn't understand the app() function, which appears to be explained by the fact it is one of the Additional operators in Azure Monitor.

How can I query my App Insights / Logs with Kusto.Explorer? I cannot use cluster as it is one of the functions not supported in Azure Monitor.

Relevant doc: Azure Monitor log query language differences

Note on troubleshooting joins

(added December 16, 2021)

Pro-tip from Kusto team: If you are querying application insights from Kusto.Explorer, and your joins to normal clusters fail with bad gateway or other unexpected error, consider adding hint.remote=left to your join. Like:

tableFromApplicationInsights
| join kind=innerunique hint.remote=left tableFromNormalKustoCluster

Answer 1

Step 1 Connection String

Build your connection string from this template:

https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>

Fill in the subscription-id, resource-group-name, and ai-app-name from the portal. Here is an example image

Step 2 Add the connection to Kusto.Explorer

Open Kusto.Explorer, choose Add Connection, and paste your connection string into the Cluster connection field.

After you kit OK, Windows will prompt you to log in with your Azure Active Directory account. Once you have authenticated, Kusto.Explorer will display the Application Insights tables in the Connections panel.

Answer 2

We have a private preview for Azure Data Explorer (ADX) Proxy that enables you to treat Log Analytics / Application Insights as a virtual cluster, query it using ADX tools and connecting to it as a second cluster in cross cluster query. Since its a private preview you need to contact [email protected] in order to get enrolled. The proxy is documented at https://docs.microsoft.com/en-us/azure/data-explorer/query-monitor-data.

(disclaimer - I'm the PM driving this project).