Есть ли какие-либо запросы KQL для извлечения просмотров страниц, количества загрузок из журналов W3C IISlog в аналитике Azure-Log?

Question

Мы пытаемся извлечь просмотры страниц, количество скачиваний файлов, список пользователей из журналов w3c IIS. мы хотим определить, что такое просмотр страницы, т. е. любой пользователь оставался на той же странице более 10 секунд для просмотра одной страницы. все, что меньше, это не просмотр страницы. Журналы w3c, кажется, не имеют достаточно данных, чтобы извлечь это. это возможно с тем, что уже доступно?

Это данные, доступные для извлечения вышеуказанной информации,

Оператор данных

datatable (TimeGenerated:datetime, csUriStem:string, scStatus:string, csUserName:string, sSiteName:string) [datetime(2019-04-12T11:55:13Z),"/Account/","302","-","WebsiteName", datetime(2019-04-12T11:55:16Z),"/","302","-","WebsiteName", datetime(2019-04-12T11:55:17Z),"/Account/","200","[e-mail]","WebsiteName", datetime(2019-04-12T11:55:17Z),"/Content/site.css","200","-","WebsiteName", datetime(2019-04-12T11:55:17Z),"/Scripts/modernizr-2.8.3.js","200","-","WebsiteName", datetime(2019-04-12T11:55:17Z),"/Scripts/bootstrap.js","200","-","WebsiteName", datetime(2019-04-12T11:55:17Z),"/Content/bootstrap.css","200","-","WebsiteName", datetime(2019-04-12T11:55:18Z),"/Scripts/jquery-3.3.1.js","200","-","WebsiteName", datetime(2019-04-12T11:55:23Z),"/","302","-","WebsiteName", datetime(2019-04-12T11:56:39Z),"/","200","[e-mail]","WebsiteName", datetime(2019-04-12T11:57:13Z),"/Home/About","200","[e-mail]","WebsiteName", datetime(2019-04-12T11:58:16Z),"/ Главная / Контакт","200","[e-mail]","WebsiteName", datetime(2019-04-12T11:59:03Z),"/","200","[e-mail]","WebsiteName"]

Answer 1

Я не уверен, что правильно выполнил все ваши требования, но вот что нужно для начала и дать вам начальное направление.

datatable (TimeGenerated:datetime, csUriStem:string, scStatus:string, csUserName:string, sSiteName :string)
[datetime(2019-04-12T11:55:13Z),"/Account/","302","-","WebsiteName",
 datetime(2019-04-12T11:55:16Z),"/","302","-","WebsiteName", 
 datetime(2019-04-12T11:55:17Z),"/Account/","200","[e-mail]","WebsiteName",
 datetime(2019-04-12T11:55:17Z),"/Content/site.css","200","-","WebsiteName", 
 datetime(2019-04-12T11:55:17Z),"/Scripts/modernizr-2.8.3.js","200","-","WebsiteName",
 datetime(2019-04-12T11:55:17Z),"/Scripts/bootstrap.js","200","-","WebsiteName",
 datetime(2019-04-12T11:55:17Z),"/Content/bootstrap.css","200","-","WebsiteName",
 datetime(2019-04-12T11:55:18Z),"/Scripts/jquery-3.3.1.js","200","-","WebsiteName",
 datetime(2019-04-12T11:55:23Z),"/","302","-","WebsiteName",
 datetime(2019-04-12T11:56:39Z),"/","200","[e-mail]","WebsiteName",
 datetime(2019-04-12T11:57:13Z),"/Home/About","200","[e-mail]","WebsiteName",
 datetime(2019-04-12T11:58:16Z),"/Home/Contact","200","[e-mail]","WebsiteName",
 datetime(2019-04-12T11:59:03Z),"/","200","[e-mail]","WebsiteName"]
| where scStatus !in ('302') // exclude status 302
| where csUriStem !startswith '/Scripts' and csUriStem !endswith ".css"  // exclude pages coming from '/Script' and .css files
| order by TimeGenerated asc
| summarize t=make_list(TimeGenerated) by csUriStem, csUserName // create time-series of visit events
| mv-apply t to typeof(datetime) on  // run subquery on each of the series
(
    project isVisit = (t - prev(t)) > 1min // compare with previous timestamp, and see if >1min passed
    | summarize Visits=sum(isVisit)
)
| project csUriStem, csUserName, Visits

Вот ссылки на make_list() (функция агрегирования), prev () (оконная функция), оператор суммирования и оператор mv-apply