Kusto如何基于汇总行渲染Azure Function并行数timechart

在Azure Application Insights中，按InvocationId对traces条目分组追踪Azure Function并行调用时，使用的基础Kusto查询如下：

traces
| where timestamp between (todatetime('2022-06-29T21:00:00Z')..todatetime('2022-06-29T22:00:00Z'))
| where tostring(customDimensions.InvocationId) <> "" 
| summarize StartedAt=min(timestamp), FinishedAt=max(timestamp), 
            Succeeded=max(severityLevel)==1
         by operation_Id, tostring(customDimensions.InvocationId)

基于上述查询需要生成展示并行运行数量随时间变化的图表，目标是渲染timechart，按分钟维度统计当前处于运行状态的并行调用数，统计逻辑等价于countif(currentMinute between (StartedAt..FinishedAt))，查阅窗口函数、make_series算子相关文档后未找到可行实现方案。

核心思路是将每个函数调用的生命周期拆为「调用开始，并发数+1」「调用结束，并发数-1」两个离散事件，再按分钟粒度对事件值做累计求和，即可得到每个时间点的实际并行调用数，性能远高于逐时间点遍历匹配生命周期的写法。
完整可直接运行的查询语句如下：

// 计算每个函数调用的开始、结束时间，复用原有统计逻辑
let invocationLifecycle = traces
| where timestamp between (todatetime('2022-06-29T21:00:00Z')..todatetime('2022-06-29T22:00:00Z'))
| where tostring(customDimensions.InvocationId) <> "" 
| summarize StartedAt=min(timestamp), FinishedAt=max(timestamp), 
            Succeeded=max(severityLevel)==1
         by operation_Id, InvocationId = tostring(customDimensions.InvocationId);
// 生成按1分钟粒度对齐的完整时间轴
let timeAxis = range TimePoint from todatetime('2022-06-29T21:00:00Z') to todatetime('2022-06-29T22:00:00Z') step 1min;
// 将调用生命周期转换为并发计数变化事件
let deltaEvents = invocationLifecycle
| extend Event = pack_array(
    pack("EventTime", bin(StartedAt, 1min), "DeltaValue", 1),
    pack("EventTime", bin(FinishedAt, 1min), "DeltaValue", -1)
)
| mv-expand Event
| evaluate bag_unpack(Event);
// 累计计算每个时间点的并行数，渲染时间图表
timeAxis
| join kind=leftouter (
    deltaEvents
    | summarize DeltaSum = sum(DeltaValue) by EventTime
) on $left.TimePoint == $right.EventTime
| fillna(DeltaSum, 0)
| order by TimePoint asc
| extend RunningParallelCount = row_cumsum(DeltaSum)
| project TimePoint, RunningParallelCount
| render timechart

调整说明 #

• 如需修改统计粒度，直接调整range语句中的step参数即可，例如设置为5min即可按5分钟维度统计
• 分钟级统计场景下当前写法性能最优，如需秒级精度统计，可去掉时间字段的bin()对齐逻辑，配合make-series算子做滑动窗口累计
• 如需拆分统计成功、失败调用的并行数，在deltaEvents阶段保留Succeeded字段，最终汇总时按该字段拆分维度即可

内容的提问来源于stack exchange，提问作者sschmeck