Azure Logic Apps执行Application Insights日志查询返回值为0的问题求助

DevOps 小满

2026-6-23

问题

通过Azure Logic Apps的「Run query and visualize results」动作执行Application Insights日志查询时，所有指标返回值均为0，但直接在Azure Application Insights日志中执行同一查询却能得到正确结果。已验证Logic Apps到目标Application Insights资源的服务连接无误。

查询语句如下：

let TotalUsersCurrentWeek = toscalar(
    requests
    | where timestamp >= ago(7d)
    | where name == "Login request"
    | summarize TotalUsersCurrentWeek=dcount(user_Id)
);

let TotalUsersPreviousWeek = toscalar(
    requests
    | where timestamp >= ago(14d) and timestamp < ago(7d)
    | where name == "Login request"
    | summarize TotalUsersPreviousWeek=dcount(user_Id)
);

let FailedLoginsCurrentWeek = toscalar(
    requests
    | where timestamp >= ago(7d)
    | where name == "Failed login request"
    | summarize FailedLoginsCurrentWeek=count()
);

let FailedLoginsPreviousWeek = toscalar(
    requests
    | where timestamp >= ago(14d) and timestamp < ago(7d)
    | where name == "Failed login request"
    | summarize FailedLoginsPreviousWeek=count()
);

let AvgLoginTimeCurrentWeek = toscalar(
    requests
    | where timestamp >= ago(7d)
    | where name == "Login request"
    | summarize AvgLoginTimeCurrentWeek=avg(duration)
);

let AvgLoginTimePreviousWeek = toscalar(
    requests
    | where timestamp >= ago(14d) and timestamp < ago(7d)
    | where name == "Login request"
    | summarize AvgLoginTimePreviousWeek=avg(duration)
);

print 
    TotalUsersCurrentWeek, 
    TotalUsersPreviousWeek, 
    FailedLoginsCurrentWeek, 
    FailedLoginsPreviousWeek, 
    AvgLoginTimeCurrentWeek, 
    AvgLoginTimePreviousWeek
| project 
    TotalUsersCurrentWeek = TotalUsersCurrentWeek,
    TotalUsersPreviousWeek = TotalUsersPreviousWeek,
    FailedLoginsCurrentWeek = FailedLoginsCurrentWeek,
    FailedLoginsPreviousWeek = FailedLoginsPreviousWeek,
    AvgLoginTimeCurrentWeek = AvgLoginTimeCurrentWeek,
    AvgLoginTimePreviousWeek = AvgLoginTimePreviousWeek

解决方法

核对时间范围的时区差异：Logic Apps执行动作时，ago(7d)这类相对时间基于UTC时间计算，而Application Insights门户默认可能使用你的本地时区。可以把相对时间替换为绝对UTC时间测试，比如将timestamp >= ago(7d)改成timestamp >= datetime(2024-05-01T00:00:00Z) and timestamp <= datetime(2024-05-08T00:00:00Z)，确认是否返回正确数据。

调整查询输出格式：当前查询用print+project返回单行多列结果，可能不兼容Logic Apps的解析逻辑。建议改成键值对格式的输出，比如：

union 
    (requests | where timestamp >= ago(7d) | where name == "Login request" | summarize MetricValue=dcount(user_Id) | extend MetricName="TotalUsersCurrentWeek"),
    (requests | where timestamp >= ago(14d) and timestamp < ago(7d) | where name == "Login request" | summarize MetricValue=dcount(user_Id) | extend MetricName="TotalUsersPreviousWeek"),
    (requests | where timestamp >= ago(7d) | where name == "Failed login request" | summarize MetricValue=count() | extend MetricName="FailedLoginsCurrentWeek"),
    (requests | where timestamp >= ago(14d) and timestamp < ago(7d) | where name == "Failed login request" | summarize MetricValue=count() | extend MetricName="FailedLoginsPreviousWeek"),
    (requests | where timestamp >= ago(7d) | where name == "Login request" | summarize MetricValue=avg(duration) | extend MetricName="AvgLoginTimeCurrentWeek"),
    (requests | where timestamp >= ago(14d) and timestamp < ago(7d) | where name == "Login request" | summarize MetricValue=avg(duration) | extend MetricName="AvgLoginTimePreviousWeek")

检查动作的查询类型设置：在「Run query and visualize results」动作中，确认「Query type」选择的是Logs，选错类型会导致查询执行异常。
验证原始查询输出：在Logic Apps中添加「Compose」动作，输出查询的原始返回结果，查看JSON结构里的数值是否正确。如果原始返回正确，问题出在后续数据提取或可视化环节；如果原始返回就是0，需排查查询执行的权限或资源上下文。
确认服务连接的权限：即使连接测试通过，也要确保连接使用的身份（托管标识或服务主体）拥有Application Insights资源的Logs Reader或更高权限，权限不足可能导致查询返回空结果，聚合后显示为0。

内容的提问来源于stack exchange，提问作者Sathish Mugithe