Overview
This sample demonstrates how to use Business Activity Monitoring (BAM) data queries to track an employee benefits process built on Logic App Consumption. The process reads employee data from a data source and delivers it to a partner system in three stages: retrieving the data, transforming it, and delivering the output file.
Business value
This sample shows how to surface end-to-end visibility for a Logic App Consumption workflow without modifying the existing workflow. By querying Azure Diagnostics logs already emitted by the Logic App, you can track file name, workflow run ID, overall result, start time, end time, and a clickable link back to the Azure portal run history — all within the Turbo360 BAM portal.
Video walkthrough
The following video provides a detailed walkthrough of this sample.
Parent query
The parent query identifies individual transaction instances by joining the workflow action start event to the workflow run completion event. It returns the file name, workflow name, run ID, overall result, and start and end times for each transaction.
let runStartedEvent = AzureDiagnostics
| where OperationName == "Microsoft.Logic/workflows/workflowActionCompleted"
| where ResourceGroup == "EAI_APP_EMPLOYEEBENEFITSFILES"
| where resource_workflowName_s == "EmployeeBenefits-To-BenefitsManagement-Partner"
| where resource_actionName_s == "Parse_JSON_-_Tracking_Args"
| extend FileName = trackedProperties_fileName_s
| extend WorkFlowName = resource_workflowName_s
| extend WorkFlowRunID = resource_runId_s
| order by TimeGenerated desc
| project TimeGenerated, FileName, WorkFlowName, WorkFlowRunID;
let workflowCompetedEvents = AzureDiagnostics
| where ResourceGroup == "EAI_APP_EMPLOYEEBENEFITSFILES"
| where resource_workflowName_s == "EmployeeBenefits-To-BenefitsManagement-Partner"
| where OperationName == "Microsoft.Logic/workflows/workflowRunCompleted"
| extend Result = status_s
| extend Start = startTime_t
| extend End = endTime_t
| extend WorkFlowName = resource_workflowName_s
| extend WorkFlowRunID = resource_runId_s
| order by TimeGenerated desc
| project WorkFlowRunID, Result, Start, End;
runStartedEvent | join kind=inner workflowCompetedEvents on WorkFlowRunID
| project TimeGenerated, FileName, WorkFlowName, WorkFlowRunID,Result, Start, End
| order by TimeGenerated desc
Child queries
Each child query maps to a transaction stage. The queries below use the WorkFlowRunID promoted from the parent query as the correlation field to retrieve only the log events that belong to the current transaction instance.
Get employee data
This stage retrieves the employee benefits dataset. The query dynamically builds an Azure portal URL using the replace_strings function, which you can click in the BAM portal to open the Logic App run history directly. The project statement limits the returned columns to only those needed in the BAM portal.
let input_RunId = {WorkFlowRunID};
let subscriptionId = "08a281b8-3b07-4219-a517-b11230e9b34";
let resourceGroup = "EAI_APP_EMPLOYEEBENEFITSFILES";
let logicAppName = "EmployeeBenefits-To-BenefitsManagement-Partner";
let actionName = "HTTP_-_GET_EMPLOYEE_BENEFITS_DATASET";
let azurePortalUrlTemplate = "https://portal.azure.com/#view/Microsoft_Azure_EMA/DesignerEditorConsumption.ReactView/id/%2Fsubscriptions%2F[subscriptionId]f%2FresourceGroups%2F[resourceGroup]%2Fproviders%2FMicrosoft.Logic%2Fworkflows%2F[logicAppName]/location/northeurope/showGoBackButton~/true/isReadOnly~/true/isMonitoringView~/true/runId/%2Fsubscriptions%2F[subscriptionId]f%2FresourceGroups%2F[resourceGroup]%2Fproviders%2FMicrosoft.Logic%2Fworkflows%2F[logicAppName]%2Fruns%2F[RunId]";
let lookups = dynamic([ '[subscriptionId]', '[resourceGroup]', '[logicAppName]', '[RunId]' ]);
AzureDiagnostics
| where ResourceGroup == resourceGroup
| where resource_workflowName_s == logicAppName
| where Resource == actionName
| where ResourceProvider == "MICROSOFT.LOGIC"
| where ResourceType == "WORKFLOWS/RUNS/ACTIONS"
| where OperationName == "Microsoft.Logic/workflows/workflowActionCompleted"
//This field uses the property shared from the parent
| where resource_runId_s == input_RunId
//Extend the tracked property from the Logic App
| extend FileName = trackedProperties_fileName_s
| extend WorkFlowName = resource_workflowName_s
| extend WorkFlowRunID = resource_runId_s
| extend duration = endTime_t - startTime_t
| extend PortalUrl = replace_strings(azurePortalUrlTemplate, lookups, pack_array(subscriptionId, resourceGroup, logicAppName, resource_runId_s))
| project TimeGenerated, ResourceId, ResourceGroup, SubscriptionId, Resource, ResourceType, OperationName, status_s, startTime_t, endTime_t, resource_runId_s, resource_workflowName_s, correlation_actionTrackingId_g, correlation_clientTrackingId_s, correlation_parentRunId_s, CorrelationId, WorkFlowName, WorkFlowRunID, duration, PortalUrl
Transform data
This stage retrieves the compose action that builds the partner message, confirming that the data transformation step completed for this run.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where ResourceGroup == "EAI_APP_EMPLOYEEBENEFITSFILES"
| where resource_workflowName_s == "EmployeeBenefits-To-BenefitsManagement-Partner"
| where ResourceType == "WORKFLOWS/RUNS/ACTIONS"
| where OperationName == "Microsoft.Logic/workflows/workflowActionCompleted"
| where Resource == "COMPOSE_-_PARTNER_MESSAGE"
| where resource_runId_s == {WorkFlowRunID}
| extend FileName = trackedProperties_fileName_s
| extend WorkFlowName = resource_workflowName_s
| extend WorkFlowRunID = resource_runId_s
Deliver file to partner
This stage retrieves the blob creation action that writes the output file to the partner destination, confirming successful delivery for this run.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where ResourceGroup == "EAI_APP_EMPLOYEEBENEFITSFILES"
| where resource_workflowName_s == "EmployeeBenefits-To-BenefitsManagement-Partner"
| where ResourceType == "WORKFLOWS/RUNS/ACTIONS"
| where OperationName == "Microsoft.Logic/workflows/workflowActionCompleted"
| where Resource == "CREATE_BLOB_(V2)"
| where resource_runId_s == {WorkFlowRunID}
| extend FileName = trackedProperties_fileName_s
| extend WorkFlowName = resource_workflowName_s
| extend WorkFlowRunID = resource_runId_s