API Management

In this scenario we are exposing an API to a 3rd party application which can submit help desk tickets to our organisation.

I can create a BAM view from the API logs in App Insights to create a user friendly view to help the support operators.

They can also open up a transaction and view additional stages within the transaction.

Walk Thru Video

This video will give a walk thru of this scenario.

Parent Transaction Query

In this case I am looking at the requests for my create ticket api operation.
I am using a replace function to get the ticket id from the query string.  You could also use headers you might have tracked for extracting business properties or perhaps you saved message bodies in the log too.

requests 
| where customDimensions.["API Name"] == "external-api-helpdesk-system-proxy"
| where customDimensions.["Operation Name"] == "create-ticket"
| extend ticket = replace_string(url, "https://kv-eai-apim.azure-api.net/external/helpdesk/tickets/", "")
| project timestamp, ticket, id, success, resultCode, duration, operation_Id

Request stage in Transaction Query

In this action I am performing a lookup for the request log event.  I am also using a creating a url for the Azure Portal so I can click through from BAM to the App Insights telemetry if I want to.

let input_item_id = {itemId};
let resourceGroup = "Platform";
let subscriptionId = "08a281b8-3b07-4219-a517-b11230e9b34f";
let appInsightsName = "kv-eai-apim-appinsights";
let portalUrlTemplate = "https://portal.azure.com/#blade/AppInsightsExtension/DetailsV2Blade/DataModel/%7B%22eventId%22:%22[RequestID]%22,%22timestamp%22:%22[startTime]%22%7D/ComponentId/%7B%22Name%22:%22[appInsightsName]%22,%22ResourceGroup%22:%22[resourceGroup]%22,%22SubscriptionId%22:%22[subscription]%22%7D";
let lookups = dynamic([ '[subscription]', '[resourceGroup]', '[appInsightsName]' ]);
let portalUrl = replace_strings(portalUrlTemplate, lookups, pack_array(subscriptionId, resourceGroup, appInsightsName));
requests
| where itemId == input_item_id
| extend azure_portal_url = replace_string(replace_string(portalUrl, "[RequestID]", itemId), "[startTime]", tostring(datetime_add('hour', -1, timestamp)))
| project timestamp, id, name, success, resultCode, duration, customDimensions, customMeasurements, operation_Id, user_AuthenticatedId, operation_ParentId, cloud_RoleInstance, cloud_RoleName, appName, itemId, itemCount, url, azure_portal_url

Backend Stage in Transaction Query

In this case I am looking for the dependency call which would match to my backend on the API.  I can correlate with the operation id

dependencies
| where operation_Id == {operation_Id}