Optimise the query to join multiple dimensions in Data Explorer

rgarzon1 — Thu, 15 Jun 2023 09:29:08 GMT

I've got this custom metric from a log resource, and I'm trying to figure out if I can optimize this query to get a cool SLO.

i have been giving it a shot, but I just can't seem to make it work

(

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","400")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","401")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","403")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","404")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","406")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","409")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","410")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","500")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","501")))):sum():default(0))

(log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","503")))):sum():default(0))

)

Re: Join multiple dimensions in data explorer

rgarzon1 — Mon, 29 May 2023 19:28:16 GMT

i know that i can do something like this, but it just looks so awful that i refuse to accept that its the only way.

rgarzon1 — Tue, 20 Jun 2023 01:01:52 GMT

at the end the easy way its use prefix

:filter(or(prefix("azuremngm.responsecode",4),prefix("azuremngm.responsecode",5))