Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add error logs query in Azure #1192

Merged
merged 4 commits into from
Jul 25, 2024
Merged

Add error logs query in Azure #1192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f49f84a
Added query for error logs and updated raw logs query
basiliskus Jul 24, 2024
dae835f
Updated resource names
basiliskus Jul 24, 2024
c35647c
Removed level column
basiliskus Jul 24, 2024
a330d9a
Removed test logging at startup to reduce noise in azure logs
basiliskus Jul 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions app/src/main/java/gov/hhs/cdc/trustedintermediary/external/javalin/DomainsRegistration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,6 @@ public static void registerDomains(
Javalin app, Set<Class<? extends DomainConnector>> domainConnectors)
throws UnableToReadOpenApiSpecificationException, DomainConnectorConstructionException {

LOGGER.logInfo("Info");
LOGGER.logWarning("Warning");
LOGGER.logDebug("Debug");
LOGGER.logError("Error");
Comment on lines -44 to -47
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent.


var instantiatedDomains = new HashSet<DomainConnector>();
for (Class<? extends DomainConnector> domainConnector : domainConnectors) {
DomainConnector connector = constructNewDomainConnector(domainConnector);
Expand Down
14 changes: 12 additions & 2 deletions operations/template/logs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,24 @@ resource "azurerm_log_analytics_query_pack" "application_logs_pack" {
location = data.azurerm_resource_group.group.location
}

resource "azurerm_log_analytics_query_pack_query" "example" {
resource "azurerm_log_analytics_query_pack_query" "application_logs" {
display_name = "TI's Raw Application Logs"
description = "View all TI's application logs in a structured format"

query_pack_id = azurerm_log_analytics_query_pack.application_logs_pack.id
categories = ["applications"]

body = "AppServiceConsoleLogs | extend JsonResult = parse_json(ResultDescription) | project-away TimeGenerated, Level, ResultDescription, Host, Type, _ResourceId, OperationName, TenantId, SourceSystem | evaluate bag_unpack(JsonResult)"
body = "AppServiceConsoleLogs | project JsonResult = parse_json(ResultDescription) | evaluate bag_unpack(JsonResult) | project-reorder ['@timestamp'], level, message"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we are no longer removing the TimeGenerated, Level, ResultDescription, Host, Type, _ResourceId, OperationName, TenantId, SourceSystem items from the logs? I'm under the impression that those are worthless columns that don't give us any benefit.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, because those columns are not included in the results anymore, so there is no need to remove them. I think the way the query was built before using extend was including those columns, but I changed that to use project instead

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh! Hardcore!

}

resource "azurerm_log_analytics_query_pack_query" "application_error_logs" {
display_name = "TI's Application Error Logs"
description = "View all TI's application logs with error level in a structured format"

query_pack_id = azurerm_log_analytics_query_pack.application_logs_pack.id
categories = ["applications"]

body = "AppServiceConsoleLogs | project JsonResult = parse_json(ResultDescription) | evaluate bag_unpack(JsonResult) | where level == 'ERROR' | project-away level | project-reorder ['@timestamp'], message"
}

resource "azurerm_monitor_diagnostic_setting" "app_to_logs" {
Expand Down