KQL Query to filter Message based on Grafana Variable

Question

In an KQL Query, displaying Azure Function App Logs, that will be used in Grafana, we want to have an Variable "Show Host Status Messages" in Grafana.

If "$ShowHostStatus" == True, show all Messages. If "$ShowHostStatus" == False, show all Messages, but filter out all messages starting with "Host Status". (where Message !startswith "Host Status")

Would it be possible to use a Query similar to this, applying some inline filter for messages inside {Message_Filtered_For_Host_Status} ?

FunctionAppLogs
| where AppName == "$FunctionApp"
| extend Message = iff(("$ShowHostStatus" == "True"), Message, {Message_Filtered_For_Host_Status} )
| project TimeGenerated, FunctionName, Level, Message

Answer 1

I don't have access to a Granfa to test sorry, but would something like the following work?

| where "$ShowHostStatus" or Message !startswith 'Host Status'

PoC code with different variable name.

let FunctionAppLogs = datatable (TimeGenerated:datetime, FunctionName:string, Level:int, Message:string, AppName:string) [
datetime('2024-03-27'), 'Blah', 1, 'Host Status 1', '$FunctionApp',
datetime('2024-03-27'), 'Blah', 2, 'Status 1', '$FunctionApp',
datetime('2024-03-27'), 'Blah', 3, 'Host Status 2', '$FunctionApp',
datetime('2024-03-27'), 'Blah', 1, 'Something 1', '$FunctionApp'
];
let ShowHostStatus = false;
FunctionAppLogs
| where AppName == "$FunctionApp"
| where ShowHostStatus or Message !startswith 'Host Status'
| project TimeGenerated, FunctionName, Level, Message

TimeGenerated	FunctionName	Level	Message
2024-03-27T00:00:00Z	Blah	2	Status 1
2024-03-27T00:00:00Z	Blah	1	Something 1