How to report on serialized JSON object data in Application Insights/Azure Monitor using Kusto

Application Insights is great for collecting telemetry from your application. You have a lot of control and in addition to the telemetry automatically collected you can also make your own calls to log custom telemetry events and collect variable/state data from your application. This type of data can be very useful for troubleshooting and diagnosing issues. The Microsoft documentation on Application Insights covers this in a good level of detail.

I’ve covered logging simple key/value pairs using custom properties and then how to query/report on them previously. In some cases though you want to be able to log more complex data than just simple key/value pairs.

In this post I’m going to show you how to log entire complex object structures in a single Application Insights trace event. Then we’ll see how we can deserialize the data to craft powerful Kusto queries in Azure Monitor.

In the following code snippet I’m creating three Person objects which have FirstName, LastName, and OfficeLocation properties. Notice the OfficeLocation property is another object (of type Location) which has properties for Region, Country, City. The code then serializes each of the Person objects to a JSON formatted string and then makes a simple Application Insights TrackTrace call passing the serialized data as the message. I recommend doing it this way as the Trace message supports up to 32,768 characters where using custom properties is limited to 8,192 characters (as documented in the Application Insights API Limits).

Serializing object data as JSON for logging

The code above calls TrackTrace for each person resulting in 3 trace events in Application Insights.

Traces in Application Insights with serialized object data in message

This is great, we’ve been able to capture a lot of valuable data, but it’s hard to work with as it’s a JSON string dumped into a single message column right? parse_json to the rescue. We can use parse_json to deserialize the message value and extract properties of the data to query and report on.

Above we parse the string value in message to an object in a new column called person. Then we reference the person column and extract specific properties of the Person object and can even navigate into the OfficeLocation object and extract the City from within in it.

Ok let’s take this to the final step and use the extracted value in a query. Imagine we wanted find all entries for people with an office in New York. Since we’ve extracted the officeCity from our JSON string it’s now super simple to use it in the where clause as shown below.

This gives you an incredibly powerful technique to see what’s happening in your application.

One thought on “How to report on serialized JSON object data in Application Insights/Azure Monitor using Kusto

Add yours

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Create a website or blog at WordPress.com

Up ↑

%d bloggers like this: