How many App Insights and Log Analytics resources do you actually need?
Probably fewer than you think, and there is a good reason for that.
Published September 1, 2026
Tags: bicep, logging, diagnostic-settings, kusto
How many log analytics and application insights resources do I need?
Like most things, the answer starts with “it depends.” The portal makes it easy to turn on logging, but it also nudges you toward giving every resource its own little logging island. Sometimes that is the right move. Most of the time, I think it is worth asking a few more questions first.
Does this resource really stand alone? In practice, true isolation is pretty rare. Even well-secured resources usually have to work with other pieces of the system to be useful.
If resources can affect one another, then the logs should show that relationship too. That is why I usually lean toward shared centralized logging. It is easier to understand what happened when the data tells the same story across the whole system.
How far to share this centralized set of resources?
I would not cross a subscription or region boundary unless there is a real reason to do it. The region boundary is the one that usually bites first because of latency. You can plan for that with log shipping, but if you do not plan for it, it is an easy way to make a good setup feel clunky. Subscription boundaries do not add latency, but they do add friction because the subscription info has to show up in the queries and connections. That can still be worth it if you know why you are doing it.
Environment boundaries are where things get a little messier. Some people keep everything in one subscription and are perfectly happy filtering by production and non-production. Others prefer to split logging by environment or by system. That can work too, but shared resources make it more complicated than it first looks.
One of the filters that makes centralized logging actually work is cloud_roleName. Application Insights already plays nicely with built-in role filters, so you can look at one app or see how several apps depend on each other. You may even find that a resource you thought was separate is not really separate at all.
Here is a query that shows roleName and some screenshots of it in action.
traces
| summarize count() by cloud_RoleName
| order by count_ descIf you already have multiple Application Insights and Log Analytics resources, here is how to combine query results across them.