Worked examples

1['api-gateway-prod']
2| where _time > ago(15m)
3| summarize requests = count(), errors = countif(status >= 500) by service
4| extend error_rate = round(100.0 * errors / requests, 2)
5| where errors > 0
6| order by error_rate desc

1['api-gateway-prod']
2| where _time > ago(1h)
3| summarize p95 = percentile(latency, 95), calls = count() by route
4| where calls > 50
5| order by p95 desc
6| take 10

1['api-gateway-prod']
2| where _time > ago(2h)
3| extend window = iff(_time < ago(1h), "before", "after")
4| summarize p95 = percentile(latency, 95), errors = countif(status >= 500) by service, window
5| order by service asc, window asc

1['api-gateway-prod']
2| where _time > ago(7d)
3| summarize events = count(), bytes = sum(estimate_size()) by service
4| extend share = round(100.0 * bytes / toscalar(sum(bytes)), 1)
5| order by bytes desc

1['api-gateway-prod']
2| where ['trace.id'] == "7b2d93c3ab4c2f10"
3| project _time, service, route, status, latency, message
4| order by _time asc

1['api-gateway-prod']
2| where _time > ago(1h) and status >= 500
3| summarize seen_now = count() by message
4| join kind=leftanti (
5    ['api-gateway-prod']
6    | where _time between (ago(30d) .. ago(1h)) and status >= 500
7    | distinct message
8  ) on message
9| order by seen_now desc