Configure Azure monitor for application logs

Question

Let us consider a hypothetical scenario where I have two VMs, each runnning a separate application e.g one running an internal dashboard (called Internal) and another running the main server (called External) for my application.

Both the applications have their log files in /var/log/application.log file in their respective machines. I want to be able to setup Azure Monitor such that I can search the logs of Internal and External machines/applications separately.

I found that there is no way to associate a VM to a filter in Azure Monitor (LogAnalytics --> Advanced --> Data --> Custom Logs --> Add). It only takes a sample log file, path of the log file and adds it to the Custom Filters in the Log section of Log Analytics / VM.

In my opinion this will combine the logs found in both machines into a single stream and show them to me. OR I will have to name the log files internal-application.log and external-application.log and then add those in two separate filters and use that as a differentiating criteria.

I have tried looking into the documents and searching on the internet. All answers seem to be concerned with metrics logs of the VMs and not application logs.

Answer 1

AFAIK in your case, you need not name the log files say as 'internal-application.log' and 'external-application.log' because even if the log file path is same (say '/var/log/application.log') across multiple machines then the logs found are combined and showed into a single stream for particular log type named (say xxxxxxx_CL i.e., it may be any name which ever you have given while uploading the custom log) provided the logs will have a column named "Computer". So you may query the logs based on computer as well.

Example queries:

xxxxxxx_CL | where Computer == "VM1NAME"

xxxxxxx_CL | where Computer == "VM2NAME"

Hope this helps!!