Skip to content

KQL Query Library for Azure Functions

Use these KQL queries during incidents to validate hypotheses with telemetry. Queries target Azure Functions data in Application Insights with these core tables:

  • requests
  • traces
  • exceptions
  • dependencies
  • customMetrics

Table Name Mapping

Azure Functions telemetry can be queried from two contexts with different table names:

Application Insights (portal) Log Analytics workspace Data type
requests AppRequests HTTP and trigger invocations
traces AppTraces Log messages and custom traces
exceptions AppExceptions Unhandled and logged exceptions
dependencies AppDependencies Outbound calls to services
customMetrics AppMetrics Custom metric values
performanceCounters AppPerformanceCounters Process-level counters

Which table name to use

When querying from the Application Insights portal blade, use lowercase names (requests, traces). When querying from the Log Analytics workspace blade (or az monitor log-analytics query), use PascalCase names (AppRequests, AppTraces). Queries in this library use Application Insights conventions.

Usage notes

  1. Keep time range tight (ago(30m), ago(1h)) during triage.
  2. Always filter by app role name to avoid cross-app noise.
  3. Save high-value queries to your incident workbook.

KQL Tables Quick Reference

Table What It Contains Use When
requests HTTP trigger invocations Checking request success/failure/latency
traces Host lifecycle, custom logs Checking startup, listeners, runtime events
exceptions Error details with stack traces Identifying error types and root causes
dependencies Outbound calls to external services Checking dependency health and latency
customMetrics Metrics explicitly emitted by your app/SDK (for example TelemetryClient.TrackMetric) plus selected Azure Functions runtime metrics (for example FunctionExecutionCount) Checking custom processing/latency metrics and runtime counters

Template variable:

let appName = "func-myapp-prod";

Operations Guide

For monitoring setup and alert configuration, see Monitoring and Alerts.

graph TD
    A[KQL Query Library] --> B[Execution Queries]
    A --> C[Scaling Queries]
    A --> D[Dependency Queries]
    A --> E[Correlation Queries]
    B --> B1[Function execution summary]
    B --> B2[Failed invocations with error details]
    B --> B3[Exception trends]
    C --> C1[Cold start analysis]
    C --> C2[Scaling events timeline]
    C --> C3["Host startup/shutdown events"]
    D --> D1[Dependency call failures]
    D --> D2[Queue processing latency]
    E --> E1[Single invocation correlation]
    E --> E2[Latency vs error correlation]

Query Categories

Category Queries Purpose
Execution Function summary, failed invocations, exception trends Identify what is failing and how often
Scaling Cold start, scaling events, host lifecycle Understand scale behavior and startup health
Dependencies Dependency failures, queue processing latency Diagnose external service issues
Correlation Single invocation trace, latency vs errors Connect symptoms across telemetry sources

See Also

Sources