使用PowerShell调用Application Insights API查询日志报错排查

原始执行脚本 #

# Set the ID of the Application Insights resource you want to query
$appId = "app id"

# Set the access token for the Application Insights resource
$accessToken = "access token"

# Encode the access token as a URL-safe string
$accessToken = [System.Uri]::EscapeDataString($accessToken)

# Set the query you want to execute
$query = "customEvents"

# Construct the request body for the Application Insights query endpoint
$requestBody = @{
    appId = $appId
    query = $query
} | ConvertTo-Json

# Execute the query and retrieve the results
$queryResponse = Invoke-WebRequest -Method POST -Uri "https://api.applicationinsights.io/v1/query" -Headers @{
    "Authorization" = "Bearer $accessToken"
    "Content-Type" = "application/json"
} -Body $requestBody

# Extract the results from the response
$results = $queryResponse.Content | ConvertFrom-Json

# Print the results
$results

错误1：PathNotFoundError #

错误信息 #

Invoke-WebRequest : {"error":{"message":"The requested path does not exist","code":"PathNotFoundError","correlationId":"1e33e5cd-43a4-4108-b28d-0b0ef4c3942c"}}
At line:26 char:18
+ ... yResponse = Invoke-WebRequest -Method POST -Uri "https://api.applicat ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

原因分析 #

核心问题是对Access Token执行了URL编码操作。Authorization头中的Bearer Token不需要进行URL转义，编码后的Token会被服务器判定为无效，无法匹配到对应的Application Insights资源，从而返回路径不存在的错误。

解决方法 #

删除脚本中对Access Token编码的行：

# 移除这一行
# $accessToken = [System.Uri]::EscapeDataString($accessToken)

错误2：InsufficientAccessError #

错误信息 #

Invoke-WebRequest : {"error":{"message":"The provided credentials have insufficient access to perform the requested operation","code":"InsufficientAccessError","correlationId":

原因分析 #

1. 权限范围不匹配：分配的权限并非针对Application Insights日志查询的专用权限，或权限未直接分配到目标资源（继承权限可能存在延迟或不生效问题）
2. Access Token权限不足：获取Token时未请求正确的API权限范围，导致Token不具备查询日志的权限
3. 权限未生效：Azure AD角色权限分配后通常需要5-10分钟才能生效，若刚添加权限就执行脚本可能出现此错误

解决方法 #

• 分配正确的角色权限：给执行查询的身份（用户/服务主体）直接分配以下角色之一到目标Application Insights资源：
  • Log Analytics Reader：允许读取日志数据
  • Application Insights Component Reader：针对App Insights资源的只读权限
• 验证Token权限范围：若使用Azure AD获取Token，确保请求的Scope为：
  • 服务主体：https://api.applicationinsights.io/.default
  • 用户身份：https://api.applicationinsights.io/user_impersonation
• 等待权限生效：添加权限后等待5-10分钟再执行脚本
• 确保Token未过期：使用最新获取的有效Token执行请求

修正后的脚本 #

# Set the ID of the Application Insights resource you want to query
$appId = "app id"

# Set the access token for the Application Insights resource
$accessToken = "access token"

# Set the query you want to execute
$query = "customEvents"

# Construct the request body for the Application Insights query endpoint
$requestBody = @{
    appId = $appId
    query = $query
} | ConvertTo-Json

# Execute the query and retrieve the results
$queryResponse = Invoke-WebRequest -Method POST -Uri "https://api.applicationinsights.io/v1/query" -Headers @{
    "Authorization" = "Bearer $accessToken"
    "Content-Type" = "application/json"
} -Body $requestBody

# Extract the results from the response
$results = $queryResponse.Content | ConvertFrom-Json

# Print the results
$results

内容的提问来源于stack exchange，提问作者Yogesh Sharma