azure_log_analytics_traces

azure_log_analytics_traces.sh

azure_log_analytics_traces() {
    subscription=$1
    resource_group=$2
    workspace_name=$3
    service=$4
    timespan=${5:-"10m"}
    level_filter=${6:-""}
    
    if [[ -z "$subscription" || -z "$resource_group" || -z "$workspace_name" || -z "$service" ]]; then
        echo "Usage: azure_log_analytics_traces <subscription> <resource_group> <workspace_name> <service> [timespan] [level]"
        echo "Or use aliases: logsprd, logsacc, logsdev"
        return 1
    fi
    
    # Get workspace ID
    workspace_id=$(az monitor log-analytics workspace show --workspace-name "$workspace_name" --resource-group "$resource_group" --subscription "$subscription" --query customerId -o tsv)
    
    if [[ -z "$workspace_id" ]]; then
        echo "Failed to get workspace ID"
        return 1
    fi
    
    # Build the query
    role_name="mcplatform.$service"
    query="AppTraces | where AppRoleName == '$role_name' | where TimeGenerated >= ago($timespan)"
    
    # Add level filter if specified
    if [[ -n "$level_filter" ]]; then
        case "$level_filter" in
            DEBUG|debug) query="$query | where SeverityLevel == '0'" ;;
            INFO|info) query="$query | where SeverityLevel == '1'" ;;
            WARN|warn) query="$query | where SeverityLevel == '2'" ;;
            ERROR|error) query="$query | where SeverityLevel == '3'" ;;
            *) echo "Unknown level: $level_filter (use DEBUG, INFO, WARN, ERROR)"; return 1 ;;
        esac
    fi
    
    query="$query | order by TimeGenerated asc"
    
    # Execute query and format output
    az monitor log-analytics query \
        --workspace "$workspace_id" \
        --subscription "$subscription" \
        --analytics-query "$query" \
        --output json | \
    jq -r '.[] | "\(.TimeGenerated) [\(.SeverityLevel | if . == "1" then "INFO" elif . == "2" then "WARN" elif . == "3" then "ERROR" else "DEBUG" end)] \(.Message)"'
}

Put this function in your .bashrc / .zshrc to be able to use it.