Kusto:查询分组http状态码

Question

我正在尝试从Azure日志分析中查询一些与Azure应用程序网关相关的内容。

对于每个单独的http状态代码，我都会得到这样的查询结果：

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| summarize count() by httpStatus_d, Resource

现在我需要将这些结果分组为2xx，3xx，4xx和5xx。

对于Kusto来说，我没有找到正确的方法来实现这一点。谢谢你的提示！

Answer 1

您可以尝试使用bin()函数，例如：

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| summarize count() by bin(httpStatus_d, 100), Resource

Answer 2

感谢@yoni把我带到了正确的方向。

我这样解决了这个问题：

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| extend HTTPStatus = case(httpStatus_d between (200 .. 299), "2XX",
                       httpStatus_d between (300 .. 399), "3XX",
                       httpStatus_d between (400 .. 499), "4XX",
                       "5XX")
| summarize count() by HTTPStatus, bin(timeStamp_t, 1h)
| render timechart

Answer 3

自动按所有httpStatus_d值分组。

AzureDiagnostics 
| where TimeGenerated > ago(30d)
| summarize count=count() by httpStatus_d
| order by httpStatus_d asc