We often speak to organizations about Azure and one of the common questions is what is the difference between App Insights and Log Analytics.
In this article we will aim to discuss those differences and overlaps.
If we think about the Azure Monitoring Platform / ecosystem, then Log Analytics and App Insights both play a role within that platform as shown below.
Log Analytics plays a role in the storage of Log Data and the analysis of Log Data.
App Insights plays a role in the analysis and insights into log data.
The official line from Microsoft is that in 2018 Log Analytics and Application Insights became a single service to provide powerful end-to-end monitoring for your applications. The 2 resource types are still however separate and have different target use cases and overlaps which we will explore more below.
The key change that Microsoft has introduced was that App Insights used to be a complete standalone service whereas now you have a workspace-enabled App Insights whereby when you configure an App Insights instance you will also have a Log Analytics workspace which it points to.
Rather than having its own separate log storage, App Insights will store the logs in Log Analytics and App Insights provides views of the log data.
It’s probably easiest to think of Log Analytics as being the raw database and tables for Log data and App Insights is a set of views aimed at providing useful views on your applications’ telemetry data.
Log Analytics Use Cases
The most common use cases people will be familiar with for Log Analytics will be a Virtual Machine which will have a logging agent on it which will send telemetry to a Log Analytics workspace.
You can also configure other services to send their telemetry logs to a Log Analytics workspace with some examples such as:
- Service Bus
- Frontdoor
- SQL Azure
For many of the Azure resources you can configure the diagnostics settings to send telemetry logs to Log Analytics and this is like infrastructure level logging of how those resources are being used and how they are performing.
App Insights Use Cases
With App Insights, you are looking at more application-level use cases. Some of the examples would be things like configuring a Web App, a Function App, or API Management to send application-level telemetry to App Insights.
With the workspace-based App Insights the log data is still stored in a Log Analytics workspace but you are streaming your telemetry to App Insights and viewing it through App Insights.
A look under the hood
With Log Analytics the data sent to the logs is a more raw format and is typically in tables like AzureDiagnostics and AzureMetrics for infrastructure level logs discussed previously, but if your using App Insights you will find the Log Analytics workspace under the hood contains the tables shown below.
These are the tables where App Insights is storing the telemetry data in Log Analytics.
If you look at the “logs” through App Insights (remember we said think of the App Insights as a view on the tables in Log Analytics) you will see the following tables.
If you write a query of the requests table in App Insights that queries the log table then it is querying the AppRequests table in Log Analytics.
From the perspective of writing a query the below 2 queries are equivalent:
App Insights:
Log Analytics:
Notice that the key difference is that the filter on the _resourceId field gets to the app insights resource and the TimeGenerated field in Log Analytics is seen as timestamp in App Insights.
What additional value does App Insights provide on top of Log Analytics
Reiterating the point that Log Analytics is the log storage and App Insights is a layer on top aimed at providing friendly views of the Log data to suit application performance management for apps built with App Service, Function Apps or even if your using a Server based IIS app with the telemetry agent, the thing App Insights gives you are added value features which use that log data and present it in ways which help you build and operate awesome apps.
Transaction Search
One of the most handy features of App Insights is the transaction search. This allows you to search for requests and dependencies or traces that have been executed by your application.
You can then open up the item you’re looking for and it will wind through the distributed trace and show you the call stack of services that have been called. You can see below a request to by API Management which was then forwarded to a Function App.
Application Map
The application map allows me to see the dependencies between my app and resources it may use such as an HTTP endpoint or a SQL database. App Insights will look at the telemetry captured and workout these services and their usage and performance levels.
Live Metrics
Live metrics is a great way to see a live stream overview of how your app is working and the requests it is processing.
Availability
Availability allows you to create web tests to ping endpoints in your app and test that they are working and monitor their SLA.
Failures
Failures allows you to begin exploring the errors within your app to identify common problems and areas you need to work on.
Performance
Performance shows you the average response times, usage and useful aggregations of the performance data in your app. It’s a great way to explore and monitor your app usage and to troubleshoot performance issues.
Usage
Usage provides a number of features aimed at helping you explore the user experience and usage of your application.
You can begin to understand user journeys in your app and how it is used in the real world.
There are also lots of deeper dive views and dashboards you can look into.
What do App Insights and Log Analytics mean for Serverless360
Log Analytics and App Insights are awesome features on Azure and they can really help your team. The challenge with them really falls into the area of roles and responsibilities. In an organization, the Azure experts will be really comfortable with using App Insights and Log Analytics and can do deep dive analysis and learn deep insights about application performance.
The problem is that not everyone in the organization who is a stakeholder in the application or IT operations is an Azure expert and, in most cases, Azure experts are a premium and scarce resource for most organizations.
The value proposition for Serverless360 in this case is to be able to leverage App Insights and Log Analytics data but to present it in a much more consumable format for the IT operations team so they can understand the data in the context of an application they are supporting without needing the steep learning curve to use Azure.
Serverless360 is all about lowering the total cost of ownership of your solutions by moving support to the left away from your experts and allowing your support teams to be more productive.
The example below is a dashboard we created for one of our application teams which shows an overview of how the web services from their application which we expose through API Management are performing.
You can learn more about how Serverless360 democratizes support of Azure solutions around App Insights and Log Analytics via the following articles:
- Integrating Log Analytics with Serverless360
- Serverless360 and Application Insights
- Enable your security manager to see Frontdoor WAF data
- Comparing Log Analytics, App Insights and Serverless360 BAM when using Logic Apps
- Azure Monitor & Serverless360
Conclusion
Hopefully, this article clarifies your understanding of the relationship between Log Analytics and App Insights. Log Analytics is the log storage and query resource which can be used by both infrastructure-level and application-level solutions. It is about storage and query of log data.
Application Insights is a layer on top of Log Analytics aimed at application-level telemetry and uses the log data stored in Log Analytics to provide an additional bunch of features that make App Insights an Application Performance Management tool.
Both are highly likely to be part of your architecture and provide great features to help you build better apps and operate well used infrastructure.
Top comments (0)