Skip to content

Instantly share code, notes, and snippets.

Last active November 7, 2023 09:23
Show Gist options
  • Save kdemanuele/a6948ba042c80fd3abd336e91e9ebdbc to your computer and use it in GitHub Desktop.
Save kdemanuele/a6948ba042c80fd3abd336e91e9ebdbc to your computer and use it in GitHub Desktop.
Azure Data Explorer - API Management Monitoring Data
.create table APIManagementDiagnosticLogs (
Timestamp: datetime,
Category: string,
ResourceId: string,
OperationName: string,
Method: string,
Url: string,
BackendResponseCode: int,
ResponseCode: int,
ResponseSize: int,
Cache: string,
BackendTime: long,
RequestSize: long,
ApiId: string,
OperationId: string,
ClientProtocol: string,
BackendProtocol: string,
BackendId: string,
ApiRevision: string,
ClientTlsVersion: string,
BackendMethod: string,
BackendUrl: string,
DeploymentVersion: string,
Level: int,
IsRequestSuccess: bool,
DurationMs: long,
CallerIpAddress: string,
CorrelationId: string,
Location: string,
Result: string,
Truncated: long
.alter table APIManagementDiagnosticLogs policy update @'[{"Source": "DiagnosticRawRecords", "Query": "APIMDiagnosticLogsExpand()", "IsEnabled": "True", "IsTransactional": true}]';
.create-or-alter function APIMDiagnosticLogsExpand() {
| mv-expand events = Records
| where isnotempty(events.operationName) and events.operationName startswith "Microsoft.ApiManagement/GatewayLogs"
| project
Timestamp = todatetime(events['time']),
Category = tostring(events.category),
ResourceId = tostring(events.resourceId),
OperationName = tostring(events.operationName),
Method = tostring(,
Url = tostring(,
BackendResponseCode = toint(,
ResponseCode = toint(,
ResponseSize = toint(events.proeprties.responseSize),
Cache = tostring(,
BackendTime = tolong(,
RequestSize = tolong(,
ApiId = tostring(,
OperationId = tostring(,
ClientProtocol = tostring(,
BackendProtocol = tostring(,
BackendId = tostring(,
ApiRevision = tostring(,
ClientTlsVersion = tostring(,
BackendMethod = tostring(,
BackendUrl = tostring(,
DeploymentVersion = tostring(events.DeploymentVersion),
Level = toint(events.Level),
IsRequestSuccess = tobool(events.isRequestSuccess),
DurationMs = tolong(events.durationMs),
CallerIpAddress = tostring(events.callerIpAddress),
CorrelationId = tostring(events.correlationId),
Location = tostring(events.location),
Result = tostring(events.resultType),
Truncated = tolong(events.truncated)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment