Ingestion-time transformation in workspace/App Insights

Author: hardik-desai-nhs

application/CohortManager/src/Functions/Shared/Common/Extensions/TelemetryExtension.cs

@@ -9,15 +9,15 @@ public static class TelemetryExtension
 {
     public static IHostBuilder AddTelemetry(this IHostBuilder hostBuilder)
     {
-        return hostBuilder.ConfigureServices(_ =>
+        return hostBuilder.ConfigureServices(sc =>
         {
-            _.AddApplicationInsightsTelemetryWorkerService();
-            _.ConfigureFunctionsApplicationInsights();
-            _.ConfigureTelemetryModule<DependencyTrackingTelemetryModule>((module, o) =>
+            sc.AddApplicationInsightsTelemetryWorkerService();
+            sc.ConfigureFunctionsApplicationInsights();
+            sc.ConfigureTelemetryModule<DependencyTrackingTelemetryModule>((module, o) =>
                 {
                     module.SetComponentCorrelationHttpHeaders = true;
                 });
-            _.AddApplicationInsightsTelemetryProcessor<HealthCheckFilterTelemetryProcessor>();
+            sc.AddApplicationInsightsTelemetryProcessor<HealthCheckFilterTelemetryProcessor>();
         });
     }
 

application/CohortManager/src/Functions/Shared/Common/HealthCheckTelemetryFilter.cs

@@ -4,7 +4,15 @@ namespace Common;
 using Microsoft.ApplicationInsights.DataContracts;
 using Microsoft.ApplicationInsights.Extensibility;
 
-public class HealthCheckFilterTelemetryProcessor : ITelemetryProcessor
+/// <summary>
+/// Filters health check telemetry emitted by the worker process.
+/// Note: In the isolated worker model, RequestTelemetry for HTTP triggers is emitted
+/// by the host process and does not flow through this processor.
+/// Host-emitted request telemetry cannot be filtered here — see
+/// https://github.com/Azure/azure-functions-dotnet-worker/issues/2024
+/// Trace telemetry is filtered via host.json logLevel settings.
+/// </summary>
+public class HealthCheckFilterTelemetryProcessor : ITelemetryProcessor, ITelemetryInitializer
 {
     private readonly ITelemetryProcessor _next;
 
@@ -25,14 +33,11 @@ public void Process(ITelemetry item)
 
     private static bool IsHealthCheckTelemetry(ITelemetry item)
     {
+        //request telemetry is emitted by the host process and does not flow through this processor,
+        //so we won't see those here to filter on. We can only filter on dependency and trace telemetry emitted by the worker process.
+        //this is confirmed by microsoft support in this GitHub issue https://github.com/Azure/azure-functions-dotnet-worker/issues/2024
         if (item is RequestTelemetry request)
         {
-            if (request.Properties.TryGetValue("FullName", out var fullName) &&
-                fullName.Equals("Functions.health", StringComparison.OrdinalIgnoreCase))
-            {
-                return true;
-            }
-
             return request.Name?.Equals("health", StringComparison.OrdinalIgnoreCase) == true ||
                    request.Url?.AbsolutePath.Contains("/health", StringComparison.OrdinalIgnoreCase) == true;
         }
@@ -74,4 +79,9 @@ private static bool IsException(ITelemetry item)
 
         return item is ExceptionTelemetry;
     }
+
+    public void Initialize(ITelemetry telemetry)
+    {
+        throw new NotImplementedException();
+    }
 }

infrastructure/tf-audit/environments/integration.tfvars

@@ -40,10 +40,11 @@ app_insights = {
 }
 
 law = {
-  law_sku            = "PerGB2018"
-  retention_days     = 30
-  export_enabled     = false
-  export_table_names = ["Alert"]
+  law_sku                        = "PerGB2018"
+  retention_days                 = 30
+  export_enabled                 = false
+  export_table_names             = ["Alert"]
+  app_requests_transform_enabled = true
 }
 
 storage_accounts = {
@@ -71,7 +72,7 @@ storage_accounts = {
     access_tier                             = "Cold"
     containers = {
       sql-backups-immutable = {
-        container_name        = "sql-backups-immutable"
+        container_name        = "sql-back-ups-immutable"
         container_access_type = "private"
         immutability_policy = {
           is_locked                           = false

infrastructure/tf-audit/ingestion_transformations.tf

@@ -0,0 +1,22 @@
+resource "azurerm_monitor_data_collection_rule" "app_requests_workspace_transform" {
+  count = var.law.app_requests_transform_enabled ? 1 : 0
+
+  name                = "${module.regions_config[local.primary_region].names.log-analytics-workspace}-apprequests-transform"
+  resource_group_name = azurerm_resource_group.audit[local.primary_region].name
+  location            = local.primary_region
+  kind                = "WorkspaceTransforms"
+
+  destinations {
+    log_analytics {
+      workspace_resource_id = module.log_analytics_workspace_audit[local.primary_region].id
+      name                  = "workspace"
+    }
+  }
+
+  data_flow {
+    streams       = ["Microsoft-Table-AppRequests"]
+    destinations  = ["workspace"]
+    transform_kql = var.law.app_requests_transform_kql
+    output_stream = "Microsoft-Table-AppRequests"
+  }
+}

infrastructure/tf-audit/variables.tf

@@ -79,11 +79,13 @@ variable "app_insights" {
 variable "law" {
   description = "Configuration of the Log Analytics Workspace"
   type = object({
-    name               = optional(string, "cohman")
-    law_sku            = optional(string, "PerGB2018")
-    retention_days     = optional(number, 30)
-    export_enabled     = optional(bool, false)
-    export_table_names = optional(list(string), [])
+    name                           = optional(string, "cohman")
+    law_sku                        = optional(string, "PerGB2018")
+    retention_days                 = optional(number, 30)
+    export_enabled                 = optional(bool, false)
+    export_table_names             = optional(list(string), [])
+    app_requests_transform_enabled = optional(bool, false)
+    app_requests_transform_kql     = optional(string, "source | where not(tolower(Name) == \"health\" and tostring(Url) endswith \"/api/health\" and tostring(Properties[\"Category\"]) == \"Host.Results\")")
   })
 }