Examkin

Soru

Zorluk: ZorQuery and Analyze Application Insights Telemetry

A development team is troubleshooting intermittent database connectivity errors in an Azure Web App. You need to write a Kusto Query Language (KQL) query in Application Insights to correlate failed dependency calls with exceptions. The query must return the target of the failed dependency, the associated exception details, and the operation ID. To prevent query timeouts on high-volume production logs, the query must be optimized to scan the minimum amount of data possible within the last 24 hours.

Which KQL query should you use?

  1. dependencies
    | where timestamp > ago(24h) and success == false
    | join kind=inner (
    exceptions
    | where timestamp > ago(24h)
    ) on operation_Id
    | project timestamp, operation_Id, target, outerMessage    Cevap
  2. B
    dependencies
    | join kind=inner (
    exceptions
    ) on operation_Id
    | where timestamp > ago(24h) and success == false
    | project timestamp, operation_Id, target, outerMessage
  3. C
    dependencies
    | where timestamp > ago(24h) and success == false
    | join kind=inner (exceptions) on operation_Id
    | project timestamp, operation_Id, target, outerMessage
  4. D
    dependencies
    | where success == false
    | join kind=inner (
    exceptions
    ) on operation_Id
    | project timestamp, operation_Id, target, outerMessage

Cevap

The query that filters both the dependencies and exceptions tables by the 24-hour time range before joining them on the operation ID.
The correct query applies the 24-hour time filter to both the dependencies table and the exceptions subquery. In Kusto, telemetry tables are partitioned by timestamp. Applying the time filter to both datasets before performing the join ensures that partition pruning is applied on both tables, drastically reducing the data scanned during the join and preventing query timeouts.

Adım Adım Çözüm

1
Apply a time-range filter to the left table (dependencies) to limit the scan size prior to joining.
The left side of the join is restricted to failed dependencies from the last 24 hours.
Kusto partitions telemetry data by time, and filtering early enables partition pruning.
2
Define an inner join subquery on the right table (exceptions) and apply the same time-range filter inside it.
The right side of the join is restricted to exceptions from the last 24 hours.
Without a filter in the subquery, Kusto would scan the entire historical log of exceptions.
3
Correlate records between the two filtered datasets using the common operation ID key.
Only matching dependencies and exceptions within the 24-hour window are joined.
This minimizes memory usage and CPU time during the join operation.
4
Use the project operator to select only the required fields.
The output contains the timestamp, operation ID, target, and exception message.
Projecting only necessary columns reduces data serialization and transfer size.

Anahtar Kavram

Partition pruning and early time-range filtering in KQL joins
Bu soruyu puanla

Konular

Query and Analyze Application Insights Telemetry