genai_spans_and_events.kql

let get_role = (event_name:string) { 
  iff(event_name == "gen_ai.choice", "assistant", split(event_name, ".")[1])
};
let gen_ai_spans = dependencies
| where isnotnull(customDimensions["gen_ai.system"])
| project 
    operation_ParentId,
    operation_Id,
    id,
    duration,
    success,
    gen_ai_operation_start = timestamp,
    name,
    gen_ai_operation_name = tostring(customDimensions["gen_ai.operation.name"]),
    gen_ai_response_id = tostring(customDimensions["gen_ai.response.id"]),
    gen_ai_response_model = tostring(customDimensions["gen_ai.response.model"]),
    gen_ai_usage_input_tokens = tostring(customDimensions["gen_ai.usage.input_tokens"]),
    gen_ai_usage_output_tokens = tostring(customDimensions["gen_ai.usage.output_tokens"]);
let gen_ai_events = traces
// there could be more than one prompt message in the history
// we need to figure out how to show them.
| where message startswith("gen_ai") or tostring(customDimensions["event.name"]) startswith("gen_ai")
| extend event_name = iff(message startswith("gen_ai"), message, tostring(customDimensions["event.name"]))
| extend event_content = iff(message startswith("gen_ai"), tostring(customDimensions["gen_ai.event.content"]), message)
| extend json=parse_json(event_content)
| extend content = iff(event_name == "gen_ai.choice", json.message, json)
| project 
    id = operation_ParentId,
    operation_Id,
    event_name,
    content = bag_merge(bag_pack("role", get_role(event_name)), content);
gen_ai_spans
| join kind=inner (gen_ai_events) on id, operation_Id
| summarize  
    Name = any(name),
    CreatedOn = any(gen_ai_operation_start),    
    Prompts = make_list_if(content, event_name != "gen_ai.choice"), 
    Completions = make_list_if(content, event_name == "gen_ai.choice"),
    DurationMs = any(duration),
    Success = any(success),
    InputTokens = any(gen_ai_usage_input_tokens),
    OutputTokens = any(gen_ai_usage_output_tokens)
by 
   id, operation_Id