Azure 日志分析 .NET SDK 中的跨工作区查询

Question

我正在使用 azure log analytics .NET SDK 来执行一些日志分析查询。

我为此 SDK 使用的 nugget 包是 Microsoft.Azure.OperationalInsights。

这允许我发出一些简单的查询，如以下代码示例：

身份验证和简单查询：

partial class QueryProvider
{

    private OperationalInsightsDataClient _operationalInsightsDataClient;


    private async void Authenticate()
    {

        // Retrieving the credentials and settings data from the app settings .
        var domain = SettingsHelpers.PullSettingsByKey("domain");
        var clientId = SettingsHelpers.PullSettingsByKey("clientId");
        var workspaceId = SettingsHelpers.PullSettingsByKey("workspaceId");

        var authEndpoint = SettingsHelpers.PullSettingsByKey("authEndpoint");
        var clientSecret = SettingsHelpers.PullSettingsByKey("clientSecret");
        var tokenAudience = SettingsHelpers.PullSettingsByKey("tokenAudience");


        // Authenticating to the azure log analytics service .
        var azureActiveDirectorySettings = new ActiveDirectoryServiceSettings
        {
            AuthenticationEndpoint = new Uri(authEndpoint),
            TokenAudience = new Uri(tokenAudience),
            ValidateAuthority = true
        };


        var credentials = await ApplicationTokenProvider.LoginSilentAsync
        (
              domain
            , clientId
            , clientSecret
            , azureActiveDirectorySettings
        );


        _operationalInsightsDataClient = new OperationalInsightsDataClient(credentials);
        _operationalInsightsDataClient.WorkspaceId = workspaceId;

    }


    public async Task<string> LogAnalyticsSamleQuery()
    {

        var query = @"Usage 
                    | where TimeGenerated > ago(3h)
                    | where DataType == 'Perf' 
                    | where QuantityUnit == 'MBytes'
                    | summarize avg(Quantity) by Computer
                    | sort by avg_Quantity desc nulls last";


       var jsonResult = await _operationalInsightsDataClient.QueryAsync(query);

        return JsonConvert.SerializeObject(jsonResult.Results);

    } 
}

现在我想编写一个运行跨工作区查询的方法，动态获取工作区 ID，并且我想构建引用所有这些工作区的查询。

我没有在文档中找到任何示例来构建此类查询。

我发现了 OperationalInsightDataClient class 的一个名为 AdditionalWorkspaces 的属性，但不清楚如何使用它来实现目标。

如有任何帮助，我们将不胜感激。

Answer 1

使用方法，将工作空间Id、CustomerId或Name存储在List中。

var ws = new List<string>();
foreach (var w in workspaces)
{
     ws.Add(w.Id);
}

AdditionalWorkspaces用于存放要查询的工作空间，不影响查询结果。

_operationalInsightsDataClient.AdditionalWorkspaces = ws;

跨工作区查询，在查询方法中加入workspace-Id列表

var jsonResult = await _operationalInsightsDataClient.QueryAsync(query,null, _operationalInsightsDataClient.AdditionalWorkspaces);

Azure 日志分析 .NET SDK 中的跨工作区查询

Cross-workspace queries in azure log analytics .NET SDK

.net

c#

azure

azure-log-analytics