open/ms-ai-architect
1
0
Fork 0
Code Issues Releases 1 Activity

docs(ms-ai-architect): KB-refresh LOW 23/52 — logging-analytics-ai-traffic: KQL ModelDeploymentName→DeploymentName, subscription/bruker-spørringer join mot ApiManagementGatewayLogs på CorrelationId

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-06-24 12:15:37 +02:00
commit 2a77e7f606
1 changed files with 22 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

31
skills/ms-ai-engineering/references/api-management/logging-analytics-ai-traffic.md
View file

@ -1,6 +1,6 @@
# Logging & Analytics for AI Traffic in APIM # Logging & Analytics for AI Traffic in APIM
**Last updated:** 2026-02 **Last updated:** 2026-06-24
**Status:** GA **Status:** GA
**Category:** API Management & AI Gateway **Category:** API Management & AI Gateway
@ -197,7 +197,7 @@ ApiManagementGatewayLlmLog
TimeGenerated, TimeGenerated,
CorrelationId, CorrelationId,
OperationName, OperationName,
ModelDeploymentName, DeploymentName,
PromptTokens, PromptTokens,
CompletionTokens, CompletionTokens,
TotalTokens, TotalTokens,
@ -209,21 +209,28 @@ ApiManagementGatewayLlmLog
PromptTokens = max(PromptTokens), PromptTokens = max(PromptTokens),
CompletionTokens = max(CompletionTokens), CompletionTokens = max(CompletionTokens),
TotalTokens = max(TotalTokens) TotalTokens = max(TotalTokens)
by TimeGenerated, CorrelationId, OperationName, ModelDeploymentName by TimeGenerated, CorrelationId, OperationName, DeploymentName
| where isnotempty(Input) and isnotempty(Output) | where isnotempty(Input) and isnotempty(Output)
``` ```
### KQL: Token-forbruk per applikasjon per dag ### KQL: Token-forbruk per applikasjon per dag
```kusto ```kusto
// Per-applikasjon krever join mot ApiManagementGatewayLogs (ApimSubscriptionId)
// på CorrelationId — ApiManagementGatewayLlmLog har ingen subscription-kolonne.
ApiManagementGatewayLlmLog ApiManagementGatewayLlmLog
| where TimeGenerated > ago(30d) | where TimeGenerated > ago(30d)
| join kind=leftouter (
ApiManagementGatewayLogs
| where TimeGenerated > ago(30d)
| distinct CorrelationId, ApimSubscriptionId
) on CorrelationId
| summarize | summarize
TotalPromptTokens = sum(PromptTokens), TotalPromptTokens = sum(PromptTokens),
TotalCompletionTokens = sum(CompletionTokens), TotalCompletionTokens = sum(CompletionTokens),
TotalTokens = sum(TotalTokens), TotalTokens = sum(TotalTokens),
RequestCount = count() RequestCount = count()
by bin(TimeGenerated, 1d), SubscriptionName = tostring(split(OperationName, "/")[0]) by bin(TimeGenerated, 1d), ApimSubscriptionId
| order by TimeGenerated desc | order by TimeGenerated desc
``` ```
@ -236,14 +243,14 @@ ApiManagementGatewayLlmLog
PromptTokens = sum(PromptTokens), PromptTokens = sum(PromptTokens),
CompletionTokens = sum(CompletionTokens), CompletionTokens = sum(CompletionTokens),
Requests = count() Requests = count()
by ModelDeploymentName by DeploymentName
| extend EstimatedCostUSD = | extend EstimatedCostUSD =
case( case(
ModelDeploymentName contains "gpt-4o", DeploymentName contains "gpt-4o",
(PromptTokens / 1000000.0 * 2.5) + (CompletionTokens / 1000000.0 * 10.0), (PromptTokens / 1000000.0 * 2.5) + (CompletionTokens / 1000000.0 * 10.0),
ModelDeploymentName contains "gpt-4o-mini", DeploymentName contains "gpt-4o-mini",
(PromptTokens / 1000000.0 * 0.15) + (CompletionTokens / 1000000.0 * 0.60), (PromptTokens / 1000000.0 * 0.15) + (CompletionTokens / 1000000.0 * 0.60),
ModelDeploymentName contains "gpt-4", DeploymentName contains "gpt-4",
(PromptTokens / 1000000.0 * 30.0) + (CompletionTokens / 1000000.0 * 60.0), (PromptTokens / 1000000.0 * 30.0) + (CompletionTokens / 1000000.0 * 60.0),
0.0 0.0
) )
@ -321,13 +328,19 @@ APIM tilbyr et innebygd Azure Monitor-basert dashboard under **Monitoring > Anal
### KQL: Topp-brukere etter token-forbruk ### KQL: Topp-brukere etter token-forbruk
```kusto ```kusto
// Brukeridentitet ligger i ApiManagementGatewayLogs — join på CorrelationId.
ApiManagementGatewayLlmLog ApiManagementGatewayLlmLog
| where TimeGenerated > ago(7d) | where TimeGenerated > ago(7d)
| join kind=leftouter (
ApiManagementGatewayLogs
| where TimeGenerated > ago(7d)
| distinct CorrelationId, ApimSubscriptionId
) on CorrelationId
| summarize | summarize
TotalTokens = sum(TotalTokens), TotalTokens = sum(TotalTokens),
Requests = count(), Requests = count(),
AvgTokensPerRequest = avg(TotalTokens) AvgTokensPerRequest = avg(TotalTokens)
by SubscriptionId by ApimSubscriptionId
| order by TotalTokens desc | order by TotalTokens desc
| take 20 | take 20
``` ```