AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |
Back to Blog
App insights12/25/2023 This greatly improves the ergonomics of constructing ad-hoc queries, which is important for real-time investigation and diagnostics. Seq's data model fully embraces structured log events. The Seq Query Language expresses this query with SQL-style syntax, leveraging the time() built-in function to group results by time interval: select sum(Product.SizeInGrams)įor software developers investigating the behavior of a system over time, queries like this are common, so Seq works hard to ensure the query can be expressed clearly and with minimal effort. Because Kusto doesn't have a built-in way to group by time intervals, it is necessary to construct a string that identifies the hour of the day in which the event occurred. The keyword summarize is the Kusto equivalent of group by. Product is declared to reduce duplication. | summarize sum(toint(Product.SizeInGrams)) by strcat(įormat_datetime(timestamp, 'yyyy-MM-dd'), | extend Product = todynamic(tostring(customDimensions.Product)) This query computes the weight of coffee sold, for each product, for each hour. Scenario #2: Sum of the weight of each product per hour The substantial character count difference here becomes apparent during interactive debugging, where the Seq syntax is considerably more efficient. This works because Seq is built specifically for structured log data. The Seq query language equivalent is: Product.Name = 'Rocket Ship Dark Roast, Ground' The awkward syntax is due to Log Analytics needing to accommodate structured logging in a data model originally designed for unstructured or semi-structured events. | where todynamic(tostring(customDimensions.Product)).Nameīecause Log Analytics stores all custom properties as strings, the customDimensions.Product value has to be cast to a string and then to dynamic, before the Name property can be extracted. Here is the Kusto query for Log Analytics: traces In this case, we wish to filter the log down to all events with a product named 'Rocket Ship Dark Roast, Ground'. ![]() One of the simplest requirements when analyzing application logs is to filter the log by an event property. Scenario #1: Find all events for the product 'Rocket Ship Dark Roast, Ground' To understand the implications of the different approaches we will examine the ergonomics of querying structured log data with each product. The screenshots below show the same events recorded in each system in Log Analytics: The example data set used in this comparison is generated using the Serilog sinks for Seq and Application Insights. These ergonomic differences between Seq and Log Analytics reflect Seq's focus on the application diagnostic experience, and Application Insights' aim to be a single, all-encompassing operational monitoring tool. Todynamic(tostring(customDimensions.Product)).Name Log Analytics has a fixed schema so it must store event properties as a JSON string in a column called customDimensions.īefore using event data you must first cast and parse the value, which is why accessing a property of an event tends to require expressions like: Event properties are accessed directly with expressions like: Product.Name This allows Seq to capture events as fully-structured objects with properties that can be compared and used in calculations. Seq supports structured logging, via the message template standard. Seq has the Seq Query Language, while Log Analytics has the " Kusto" query language. How a system captures and represents event data, and how that data can be manipulated, makes a big difference to how easy it is to find what you are looking for.īoth products include log filtering and aggregation capabilities. The rest of this article will compare Seq with Log Analytics, the component of Application Insights and Azure Monitor that provides log search and analysis, and demonstrate why Seq is often preferred when diagnosing application issues. Seq is focused on the needs of software development teams monitoring and debugging their own apps and services Despite this overlap, Application Insights and Seq have different objectives:Īpplication Insights is a data platform that addresses a wide range of operational monitoring scenarios Seq and Application Insights both collect application logs in Azure. Is Seq an alternative to Application Insights?
0 Comments
Read More
Leave a Reply. |