Azure 64: Structured Logging & Dashboards
easy⏱ 5 mincourseazure
Structured beats string
log.info('user ' + id + ' failed') is a string you must regex later. log.info({ event: 'login_failed', userId, correlationId }) is a row you can filter, group and chart. Every log should carry a correlation id (trace id) so you can pull every line for one request across every service.
// KQL in Log Analytics
traces
| where customDimensions.event == 'login_failed'
| summarize count() by bin(timestamp, 5m)
Logs, metrics, traces
The three pillars: logs (discrete events), metrics (numbers over time, cheap to aggregate), traces (causal request timelines). Dashboards are built from metrics; you drill from a metric spike → traces → the exact logs. Don't log what should be a metric — high-cardinality logging gets expensive fast.
Aggregate the logs
Given { level, msg, correlationId }[], count how many are ERROR, and print the msg of every log whose correlationId is req-7. Log errors: N, then each matching message as req-7: <msg>.
One correlation id, end to end
Generate the correlation id at the edge (gateway) and propagate it on every call and log. When an incident hits, where correlationId == 'x' reconstructs the whole story in seconds.
Quiz: what ties a user's logs together?
A correlation id (trace id) carried on every log and call lets you reconstruct one request's full path across services.