TopolearnGood queries find problems; good alerts wake the right person for the right reason, and nobody else.
Kusto Query Language (KQL) queries Log Analytics and Application Insights. A query starts with a table and pipes rows through operators:
whereto filter (put time filters first:TimeGenerated > ago(1h)),project/extendto pick and compute columns,summarize ... byto aggregate, usually withbin(TimeGenerated, 5m),join,top,render timechart, andparseorparse_jsonfor semi-structured fields.
In a workspace-based Application Insights setup, tables are AppRequests, AppDependencies, AppExceptions with column TimeGenerated; the classic requests view with timestamp still works when querying from the App Insights resource.
Alerts in Azure Monitor:
- Metric alerts: evaluate a metric every minute or so; support dynamic thresholds that learn seasonality.
- Log search alerts: run a KQL query on a schedule and fire on result count or a measured value.
- Activity log alerts: on control-plane events (deletes, Service Health incidents).
Alerts notify through action groups (email, SMS, push, webhook, Logic App, Function, ITSM). Alert processing rules suppress notifications during maintenance or route them by scope.
Alert on symptoms users feel (error rate, latency SLO burn), not on every cause, and make every alert actionable.
Example
// Failure rate and p95 latency per operation, 5-minute buckets, last 6 hours
AppRequests
| where TimeGenerated > ago(6h)
| summarize total = count(),
failed = countif(Success == false),
p95_ms = percentile(DurationMs, 95)
by OperationName, bin(TimeGenerated, 5m)
| extend failure_pct = round(100.0 * failed / total, 2)
| where total > 50 and failure_pct > 5
| order by TimeGenerated desc
// Top exception types in the last day
AppExceptions
| where TimeGenerated > ago(1d)
| summarize count() by ProblemId
| top 5 by count_Remember
- KQL pipes a table through where, extend, summarize, render
- Filter on time first; bin() buckets time series
- Metric, log search and activity log alerts all notify via action groups
- Alert on user-facing symptoms and keep alerts actionable
Watch out for
- Alerting on raw error counts without a traffic floor, so one failed request at 3 a.m. pages someone.