Application Insights vs Log Analytics — when to use which (or both)
Application Insights and Log Analytics share the same storage engine (Kusto / Azure Monitor Logs), but their schemas, ingestion paths, and UX target different jobs.
Mental model
- Application Insights (App Insights). App-centric. Auto-instruments .NET/Node/Java — captures requests, dependencies, exceptions, custom events. Best for "why is my app slow / failing?"
- Log Analytics. Workspace-centric. Receives logs from VMs, AKS, network, security, custom sources. Best for "what is happening across my infrastructure?"
Since 2021 App Insights writes into a Log Analytics workspace ("workspace-based App Insights"). One backend, two front-doors.
Tables — same engine
App Insights writes to standard tables:
| AI table | What |
|---|---|
requests | HTTP request data |
dependencies | Outgoing calls (DB, HTTP, queue) |
exceptions | Unhandled exceptions |
traces | ILogger output |
customEvents | TelemetryClient.TrackEvent |
customMetrics | TelemetryClient.TrackMetric |
Log Analytics tables — Heartbeat, Perf, AzureActivity, ContainerLog, SecurityEvent, plus anything you create with custom DCRs.
Same query language — KQL
Both queried via Kusto:
requests
| where timestamp > ago(1h)
| where success == false
| summarize count() by name, resultCode
| order by count_ desc
ContainerLog
| where TimeGenerated > ago(15m)
| where LogEntry contains "OutOfMemoryError"
Cross-querying
In a workspace-based App Insights, you can join across both worlds in one query. Useful when you want to correlate an app exception with the underlying node OOM:
let oom = ContainerLog
| where LogEntry contains "OOMKilled"
| project node = Computer, TimeGenerated;
exceptions
| join kind=inner oom on $left.cloud_RoleInstance == $right.node
When to use which
- App Insights — if you ship .NET/Node/Java apps and want zero-config tracing, the dependency map, end-to-end transactions, live metrics.
- Log Analytics — if you operate Azure infra (VMs, AKS, App Gateway, Firewall). The platform-level data lives there.
- Both — almost every production system needs both. Workspace-based AI gets you one bill, one retention policy, one set of queries.
Cost levers
- Sampling — App Insights samples requests/dependencies by default. Tune via
samplingRatioor adaptive sampling. - Data caps — set a daily cap on the workspace to prevent runaway bills.
- Basic Logs tier for high-volume cheap-and-slow logs (security analysis, infrequent queries). Limited query power but big cost saving.
The "do not bother" rule
Do not script around ApplicationInsights.config for new .NET projects. Use builder.Services.AddApplicationInsightsTelemetry() plus the OpenTelemetry exporter — App Insights is moving to OTel as the canonical ingestion path.