runId>" // to filter on correlationID replace <...> with correlationId (same as runId) - we have created a duplicate for to maintain consistency of column name across all services | where LogLevel == "ERROR" | project TimeGenerated, DagName, LogLevel, DagTaskName, CodePath, Content ...