Stream Application Insights live metrics to a local PowerShell grid view

#applicationinsights-stream-live-metrics.md

This PowerShell script streams Application Insights live metric traces to your local system and displays them in a PowerShell grid view. This is useful since the Azure Portal trace viewing experience is somewhat limited.

Warning

This script uses undocumented functionality. Exercise caution when running any scripts against your infrastructure.

To use:

1. Ensure you are logged in using Azure CLI and have selected the relevant subscription.
2. Run the script in a PowerShell terminal (tested only with PowerShell 7.3).
3. Select the relevant Application Insights resource from the first grid view. This lists all Application Insights resources in the Azure CLI logged in subscription.
4. Wait for a moment for the streaming connection to be established.
5. Another grid view will open streaming application trace events with newer events at the bottom. You can use the grid view filter and search functionality to narrow down the displayed trace rows, or columns to sort the results. Filtering does not remove rows so you can try different filters to find traces you are interested in.
6. Close the grid view to end the streaming connection.

An example of a grid view showing streaming events from an Azure Functions application. The grid view is filtered to display only rows containing the text "blob".

applicationinsights-stream-live-metrics.ps1

&{
	$ai_rid=$(az resource list --namespace Microsoft.Insights --resource-type components|convertfrom-json|ogv -t 'Select Application Insights' -o single|select -exp id)
	if($ai_rid -eq $null){write-warning "No Application Insights resources found";break}
	$ai_id=(1..32|%{0..9+'a'..'z'|get-random -shuffle|select -first 1}) -join ''
	$ai_seq=0
	$ai_token=[pscustomobject]@{expiry=get-date}
	&{do{
		if(($ai_token.expiry-(get-date)).totalminutes -lt 5){
			$ai_token=$(az rest -m get -u "$ai_rid/providers/microsoft.insights/generatelivetoken?api-version=2021-10-14"|convertfrom-json)
			$ai_token_ss=$ai_token.token|convertto-securestring -asplaintext -force
		}
		$response=irm -method post -uri "https://rt.services.visualstudio.com/queryLogs?seqNumber=$ai_seq" -authentication bearer -token $ai_token_ss -contenttype 'application/json' -body (@{Id=$ai_id;Version=1;TelemetryTypes=@('Request','Trace','Dependency','Exception','Event')}|convertto-json -compress)
		$ai_seq=($response.documents.sequencenumber|measure-object -maximum).maximum ?? 0
		$result=$response.documents|sort sequencenumber|select -exp content|select @{n='Timestamp';e={$_.timestamp.datetime}},documenttype,@{n='Message';e={if($_.documenttype -eq 'Trace'){"$($_.severitylevel):$($_.message -replace ""`r"",'' -replace ""`n"",'')"}else{"$($_.name)"}}}
		if($ai_seq -eq 0){write-warning "$(get-date) waiting for data..."}else{$result}
		start-sleep -seconds 3
	}while($true)}|ogv -t 'Application Insights live metrics...' -wait
}