Optimise the query to join multiple dimensions in Data Explorer

[rgarzon1]

Hi

I've got this custom metric from a log resource, and I'm trying to figure out if I can optimize this query to get a cool SLO.

i have been giving it a shot, but I just can't seem to make it work

(

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","400")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","401")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","403")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","404")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","406")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","409")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","410")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","500")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","501")))):sum():default(0))

    +

 (log.azure.test.apiid:filter(and(or(eq("azuremngm.apiid",APIv1)),or(eq("azuremngm.responsecode","503")))):sum():default(0))

)

[rgarzon1]

i know that i can do something like this, but it just looks so awful that i refuse to accept that its the only way.

[rgarzon1 · Accepted solution]

at the end the easy way its use prefix

:filter(or(prefix("azuremngm.responsecode",4),prefix("azuremngm.responsecode",5))