Press CTRL+K to open search

Custom logging with Event Hub and ADX

  • 2 minute(s) read
Prev Next

This sample demonstrates a common custom logging pattern using Azure Event Hub and Azure Data Explorer (ADX), showing how Turbo360 BAM data queries surface custom logging data in a view that support users and business users can work with directly — no Azure expertise required.

Architecture

In this pattern, events are written to an Event Hub by any technology capable of writing data to it. Azure Data Explorer is configured to ingest those events from the Event Hub so they can be queried using KQL. Turbo360 then queries ADX using the KQL queries you configure, presenting the logging data in views that are relevant to your scenario.

The key benefit of this pattern is that you can decouple the presentation of your log data from the logging implementation, giving you maximum flexibility.

How it works

  • The developer writes events to the Event Hub from their chosen technology.

  • Azure Data Explorer is configured to ingest events from the Event Hub.

  • The developer adds KQL queries to Turbo360.

  • L2 support users and business users use Turbo360 to see what is happening in their integrations.

  • Developers receive fewer support questions and tickets.

  • Support users and business users can self-service their queries.

Business value

This pattern lets organizations unlock the value in their custom logging data without building dedicated tooling. Any technology that can write to an Event Hub can participate, and the resulting data is surfaced in a role-appropriate view that support and business teams can use directly.

Video

Parent query

This query retrieves two events from the custom BAM table — one representing the start of the process and one representing the end. It joins them together to return one row per transaction, allowing you to search by business properties in Turbo360.

Key points about this query:

  1. The table contains multiple event types; the query filters for only the ones you need.

  2. A date field is promoted so Turbo360 can use it for time-based filtering.

  3. One of the output fields is used to correlate from the parent query to the stage queries.

  4. You can promote additional properties using the extend operator to create searchable fields in Turbo360.

let startEvents = CustomBAM
| where BusinessProcess == "Mike-Test-BusinessProcess"
| where Transaction == "Mike-Test-Transaction"
| where Stage == "Started"
| extend CustomerName = Data.Name
| extend OrderID = Data.OrderID
| extend WorkflowName = Metadata.WorkflowName
| extend RunID = Metadata.RunID;
let endEvents = CustomBAM
| where IsTransactionComplete == true;
startEvents
| join kind=leftouter endEvents on $left.TransactionInstanceID == $right.TransactionInstanceID
| project StartTime=TimeStamp, EndTime=TimeStamp_1, TransactionInstanceID, BusinessProcess, Transaction, CustomerName, OrderID, WorkflowName, RunID, TransactionStatus=coalesce(TransactionResult1, TransactionResult)

Stage query

The stage query retrieves records that match the transaction ID used as the correlation field in the parent query. You can reuse this query for each stage in Turbo360 by changing the stage name.

CustomBAM
| where TransactionInstanceID == {TransactionInstanceID}
| where Stage == "Started"
| extend CustomerName = Data.Name
| extend OrderID = Data.OrderID
| extend WorkflowName = Metadata.WorkflowName
| extend RunID = Metadata.RunID

FAQs

Can I combine multiple log sources?
Yes. Different stages in Turbo360 can come from different log sources — for example, one stage from Application Insights and the next from ADX. As long as you can provide a correlation field between the queries, the stages will link correctly.