From 2a77e7f60608aa137cfd357785bc9a2dbff09f9f Mon Sep 17 00:00:00 2001
From: Kjell Tore Guttormsen <hello@fromaitochitta.com>
Date: Wed, 24 Jun 2026 12:15:37 +0200
Subject: [PATCH] =?UTF-8?q?docs(ms-ai-architect):=20KB-refresh=20LOW=2023/?=
 =?UTF-8?q?52=20=E2=80=94=20logging-analytics-ai-traffic:=20KQL=20ModelDep?=
 =?UTF-8?q?loymentName=E2=86=92DeploymentName,=20subscription/bruker-sp?=
 =?UTF-8?q?=C3=B8rringer=20join=20mot=20ApiManagementGatewayLogs=20p=C3=A5?=
 =?UTF-8?q?=20CorrelationId?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../logging-analytics-ai-traffic.md           | 31 +++++++++++++------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/skills/ms-ai-engineering/references/api-management/logging-analytics-ai-traffic.md b/skills/ms-ai-engineering/references/api-management/logging-analytics-ai-traffic.md
index e042515..8a2bceb 100644
--- a/skills/ms-ai-engineering/references/api-management/logging-analytics-ai-traffic.md
+++ b/skills/ms-ai-engineering/references/api-management/logging-analytics-ai-traffic.md
@@ -1,6 +1,6 @@
 # Logging & Analytics for AI Traffic in APIM
 
-**Last updated:** 2026-02
+**Last updated:** 2026-06-24
 **Status:** GA
 **Category:** API Management & AI Gateway
 
@@ -197,7 +197,7 @@ ApiManagementGatewayLlmLog
     TimeGenerated,
     CorrelationId,
     OperationName,
-    ModelDeploymentName,
+    DeploymentName,
     PromptTokens,
     CompletionTokens,
     TotalTokens,
@@ -209,21 +209,28 @@ ApiManagementGatewayLlmLog
     PromptTokens = max(PromptTokens),
     CompletionTokens = max(CompletionTokens),
     TotalTokens = max(TotalTokens)
-    by TimeGenerated, CorrelationId, OperationName, ModelDeploymentName
+    by TimeGenerated, CorrelationId, OperationName, DeploymentName
 | where isnotempty(Input) and isnotempty(Output)
 ```
 
 ### KQL: Token-forbruk per applikasjon per dag
 
 ```kusto
+// Per-applikasjon krever join mot ApiManagementGatewayLogs (ApimSubscriptionId)
+// på CorrelationId — ApiManagementGatewayLlmLog har ingen subscription-kolonne.
 ApiManagementGatewayLlmLog
 | where TimeGenerated > ago(30d)
+| join kind=leftouter (
+    ApiManagementGatewayLogs
+    | where TimeGenerated > ago(30d)
+    | distinct CorrelationId, ApimSubscriptionId
+  ) on CorrelationId
 | summarize
     TotalPromptTokens = sum(PromptTokens),
     TotalCompletionTokens = sum(CompletionTokens),
     TotalTokens = sum(TotalTokens),
     RequestCount = count()
-    by bin(TimeGenerated, 1d), SubscriptionName = tostring(split(OperationName, "/")[0])
+    by bin(TimeGenerated, 1d), ApimSubscriptionId
 | order by TimeGenerated desc
 ```
 
@@ -236,14 +243,14 @@ ApiManagementGatewayLlmLog
     PromptTokens = sum(PromptTokens),
     CompletionTokens = sum(CompletionTokens),
     Requests = count()
-    by ModelDeploymentName
+    by DeploymentName
 | extend EstimatedCostUSD =
     case(
-        ModelDeploymentName contains "gpt-4o",
+        DeploymentName contains "gpt-4o",
             (PromptTokens / 1000000.0 * 2.5) + (CompletionTokens / 1000000.0 * 10.0),
-        ModelDeploymentName contains "gpt-4o-mini",
+        DeploymentName contains "gpt-4o-mini",
             (PromptTokens / 1000000.0 * 0.15) + (CompletionTokens / 1000000.0 * 0.60),
-        ModelDeploymentName contains "gpt-4",
+        DeploymentName contains "gpt-4",
             (PromptTokens / 1000000.0 * 30.0) + (CompletionTokens / 1000000.0 * 60.0),
         0.0
     )
@@ -321,13 +328,19 @@ APIM tilbyr et innebygd Azure Monitor-basert dashboard under **Monitoring > Anal
 ### KQL: Topp-brukere etter token-forbruk
 
 ```kusto
+// Brukeridentitet ligger i ApiManagementGatewayLogs — join på CorrelationId.
 ApiManagementGatewayLlmLog
 | where TimeGenerated > ago(7d)
+| join kind=leftouter (
+    ApiManagementGatewayLogs
+    | where TimeGenerated > ago(7d)
+    | distinct CorrelationId, ApimSubscriptionId
+  ) on CorrelationId
 | summarize
     TotalTokens = sum(TotalTokens),
     Requests = count(),
     AvgTokensPerRequest = avg(TotalTokens)
-    by SubscriptionId
+    by ApimSubscriptionId
 | order by TotalTokens desc
 | take 20
 ```