Fix token usage workbook: dedup events, time range params, portable resource IDs

- All token queries now use max() by (agent, process_id) dedup pattern
  to handle duplicate custom events from ContentProcessor/Workflow
- Replaced hardcoded ago(7d) with TimeRange workbook parameter so the
  time picker actually filters data correctly
- Removed hardcoded App Insights resource IDs from workbook JSON making
  it portable for redeployment to any RG via deploy-workbook.bicep
- Updated token-usage-queries.kql to match all workbook queries with
  dedup pattern and reorganized (16 queries total)
- Fixed registries: null in main.bicep/main.json for container apps

Queries fixed with dedup: Overall Summary, Pipeline Step, Token Over
Time, Daily Cost, Step-to-Model, Top 20 Consumers, Token by File Type,
Percentiles, Daily Volume, Pie Chart

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Prachig-Microsoft

infra/dashboards/token-usage-queries.kql

@@ -2,16 +2,25 @@
 // KQL Queries for LLM Token Usage Monitoring
 // Content Processing Solution Accelerator
 // Run these in Application Insights > Logs
+//
+// IMPORTANT: All queries use a deduplication pattern:
+//   max() by (agent, process_id) first, then sum()
+// This handles duplicate custom events that can occur when
+// both ContentProcessor and ContentProcessorWorkflow emit
+// telemetry through the same Application Insights instance.
 // ============================================================
 
-// 1. Overall token usage summary (last 7 days)
+// 1. Overall token usage summary
+// Dedup: max by (agent, process_id) → sum by process_id → aggregate
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
 | extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
 | extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize input_tokens=max(input_tokens), output_tokens=max(output_tokens), total_tokens=max(total_tokens) by agent, process_id
 | summarize input_tokens=sum(input_tokens), output_tokens=sum(output_tokens), total_tokens=sum(total_tokens) by process_id
 | summarize
     TotalDocuments = count(),
@@ -21,42 +30,61 @@ customEvents
     AvgTokensPerDocument = round(avg(total_tokens), 0)
 
 // 2. Token usage by pipeline step (agent)
+// Dedup: max by (agent, process_id) → sum by agent
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
 | extend agent = tostring(customDimensions['agent_name'])
+| extend process_id = tostring(customDimensions['process_id'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
 | extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize input_tokens=max(input_tokens), output_tokens=max(output_tokens), total_tokens=max(total_tokens) by agent, process_id
 | summarize
     InputTokens = sum(input_tokens),
     OutputTokens = sum(output_tokens),
     TotalTokens = sum(total_tokens),
     Invocations = count()
     by Step = agent
+| project Step, InputTokens, OutputTokens, TotalTokens, Invocations
 | order by TotalTokens desc
 
 // 3. Token usage over time (hourly)
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
 | extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
+| summarize input_tokens=max(input_tokens), output_tokens=max(output_tokens), timestamp=min(timestamp) by agent, process_id
 | summarize input_tokens=sum(input_tokens), output_tokens=sum(output_tokens), timestamp=min(timestamp) by process_id
 | summarize InputTokens = sum(input_tokens), OutputTokens = sum(output_tokens) by bin(timestamp, 1h)
 | order by timestamp asc
 | render areachart
 
-// 4. Estimated cost (GPT-4o pricing: $2.50/1M input, $10.00/1M output)
+// 4. Token distribution by agent (pie chart)
+customEvents
+| where name == 'LLM_Agent_Token_Usage'
+| where timestamp > ago(7d)
+| extend agent = tostring(customDimensions['agent_name'])
+| extend process_id = tostring(customDimensions['process_id'])
+| extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize total_tokens=max(total_tokens) by agent, process_id
+| summarize TotalTokens = sum(total_tokens) by agent
+| render piechart
+
+// 5. Estimated daily cost (GPT-4o pricing: $2.50/1M input, $10.00/1M output)
 let input_price_per_million = 2.50;
 let output_price_per_million = 10.00;
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(30d)
 | extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
+| summarize input_tokens=max(input_tokens), output_tokens=max(output_tokens), timestamp=min(timestamp) by agent, process_id
 | summarize input_tokens=sum(input_tokens), output_tokens=sum(output_tokens), timestamp=min(timestamp) by process_id
 | summarize TotalInput = sum(input_tokens), TotalOutput = sum(output_tokens) by bin(timestamp, 1d)
 | extend InputCost = round(TotalInput * input_price_per_million / 1000000.0, 4)
@@ -65,109 +93,7 @@ customEvents
 | project Day = timestamp, TotalInput, TotalOutput, InputCost, OutputCost, TotalCost
 | order by Day desc
 
-// 5. Top token consumers by document
-customEvents
-| where name == 'LLM_Agent_Token_Usage'
-| where timestamp > ago(7d)
-| extend process_id = tostring(customDimensions['process_id'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize TotalTokens = sum(total_tokens) by process_id
-| join kind=leftouter (
-    customEvents
-    | where name == 'LLM_Token_Usage_Summary'
-    | where timestamp > ago(7d)
-    | extend process_id = tostring(customDimensions['process_id'])
-    | extend file_name = tostring(customDimensions['file_name'])
-    | summarize file_name=take_any(file_name) by process_id
-) on process_id
-| project process_id, file_name, TotalTokens
-| order by TotalTokens desc
-| take 20
-
-// 6. Pipeline step token distribution (pie chart)
-customEvents
-| where name == 'LLM_Agent_Token_Usage'
-| where timestamp > ago(7d)
-| extend agent = tostring(customDimensions['agent_name'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize TotalTokens = sum(total_tokens) by agent
-| render piechart
-
-// 7. Token usage percentiles per document
-customEvents
-| where name == 'LLM_Agent_Token_Usage'
-| where timestamp > ago(7d)
-| extend process_id = tostring(customDimensions['process_id'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize total_tokens=sum(total_tokens) by process_id
-| summarize
-    p50 = percentile(total_tokens, 50),
-    p90 = percentile(total_tokens, 90),
-    p95 = percentile(total_tokens, 95),
-    p99 = percentile(total_tokens, 99),
-    Max = max(total_tokens)
-
-// 8. Token usage by step grouping (Extraction vs Analysis vs Safety)
-let StepGroupMapping = datatable(agent:string, StepGroup:string) [
-    "MapHandler", "Extraction",
-    "RAI", "Safety",
-    "Summarize", "Analysis",
-    "GapAnalysis", "Analysis"
-];
-customEvents
-| where name == 'LLM_Agent_Token_Usage'
-| where timestamp > ago(7d)
-| extend agent = tostring(customDimensions['agent_name'])
-| extend input_tokens = toint(customDimensions['input_tokens'])
-| extend output_tokens = toint(customDimensions['output_tokens'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| lookup kind=leftouter StepGroupMapping on agent
-| extend StepGroup = iff(isempty(StepGroup), "Unknown", StepGroup)
-| summarize
-    TotalRequests = count(),
-    TotalInputTokens = sum(input_tokens),
-    TotalOutputTokens = sum(output_tokens),
-    TotalTokens = sum(total_tokens),
-    AvgTokensPerRequest = round(avg(total_tokens), 0)
-    by StepGroup
-| order by TotalTokens desc
-
-// 9. Token usage by model deployment
-customEvents
-| where name == 'LLM_Model_Token_Usage'
-| where timestamp > ago(7d)
-| extend model = tostring(customDimensions['model_deployment_name'])
-| extend input_tokens = toint(customDimensions['input_tokens'])
-| extend output_tokens = toint(customDimensions['output_tokens'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize
-    InputTokens = sum(input_tokens),
-    OutputTokens = sum(output_tokens),
-    TotalTokens = sum(total_tokens),
-    Invocations = count()
-    by Model = model
-| order by TotalTokens desc
-
-// 10. Token usage by model over time (hourly)
-customEvents
-| where name == 'LLM_Model_Token_Usage'
-| where timestamp > ago(7d)
-| extend model = tostring(customDimensions['model_deployment_name'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize TotalTokens = sum(total_tokens) by bin(timestamp, 1h), model
-| order by timestamp asc
-| render areachart
-
-// 11. Model token distribution (pie chart)
-customEvents
-| where name == 'LLM_Model_Token_Usage'
-| where timestamp > ago(7d)
-| extend model = tostring(customDimensions['model_deployment_name'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize TotalTokens = sum(total_tokens) by model
-| render piechart
-
-// 12. Estimated cost by model (adjust pricing per model)
+// 6. Estimated cost by model (adjust pricing per model)
 let gpt4o_input = 2.50;
 let gpt4o_output = 10.00;
 let gpt4o_mini_input = 0.15;
@@ -191,11 +117,10 @@ customEvents
 | project Model = model, TotalInput, TotalOutput, InputCost, OutputCost, TotalCost
 | order by TotalCost desc
 
-// 13. Step-to-model mapping with token usage
+// 7. Token usage by model deployment
 customEvents
-| where name == 'LLM_Agent_Token_Usage'
+| where name == 'LLM_Model_Token_Usage'
 | where timestamp > ago(7d)
-| extend agent = tostring(customDimensions['agent_name'])
 | extend model = tostring(customDimensions['model_deployment_name'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
@@ -205,53 +130,59 @@ customEvents
     OutputTokens = sum(output_tokens),
     TotalTokens = sum(total_tokens),
     Invocations = count()
-    by Step = agent, Model = model
+    by Model = model
 | order by TotalTokens desc
 
-// 14. RAI agent specific token usage
+// 8. Step-to-model mapping with token usage
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
 | extend agent = tostring(customDimensions['agent_name'])
-| where agent == "RAI"
+| extend model = tostring(customDimensions['model_deployment_name'])
+| extend process_id = tostring(customDimensions['process_id'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
 | extend total_tokens = toint(customDimensions['total_tokens'])
-| extend model = tostring(customDimensions['model_deployment_name'])
+| summarize input_tokens=max(input_tokens), output_tokens=max(output_tokens), total_tokens=max(total_tokens) by agent, model, process_id
 | summarize
     InputTokens = sum(input_tokens),
     OutputTokens = sum(output_tokens),
     TotalTokens = sum(total_tokens),
-    Invocations = count()
-    by Model = model
+    Invocations = dcount(process_id)
+    by Step = agent, Model = model
+| order by TotalTokens desc
 
-// 15. OpenTelemetry auto-instrumented OpenAI calls (if available)
-dependencies
-| where name has "openai" or target has "openai"
+// 9. Top 20 token consumers by document
+customEvents
+| where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
-| extend input_tokens = tolong(customDimensions["gen_ai.usage.input_tokens"])
-| extend output_tokens = tolong(customDimensions["gen_ai.usage.output_tokens"])
-| extend model = tostring(customDimensions["gen_ai.request.model"])
-| where isnotnull(input_tokens)
-| summarize
-    Calls = count(),
-    TotalInput = sum(input_tokens),
-    TotalOutput = sum(output_tokens)
-    by model
-| order by TotalInput desc
-
-// ============================================================
-// Content Processing Specific Queries
-// ============================================================
+| extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
+| extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize total_tokens=max(total_tokens) by agent, process_id
+| summarize TotalTokens = sum(total_tokens) by process_id
+| join kind=leftouter (
+    customEvents
+    | where name == 'LLM_Token_Usage_Summary'
+    | where timestamp > ago(7d)
+    | extend process_id = tostring(customDimensions['process_id'])
+    | extend file_name = tostring(customDimensions['file_name'])
+    | summarize file_name=take_any(file_name) by process_id
+) on process_id
+| project process_id, file_name, TotalTokens
+| order by TotalTokens desc
+| take 20
 
-// 16. Token usage by file type (PDF, DOCX, image, etc.)
+// 10. Token usage by file type (PDF, DOCX, image, etc.)
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
 | extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
 | extend input_tokens = toint(customDimensions['input_tokens'])
 | extend output_tokens = toint(customDimensions['output_tokens'])
 | extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize input_tokens=max(input_tokens), output_tokens=max(output_tokens), total_tokens=max(total_tokens) by agent, process_id
 | summarize input_tokens=sum(input_tokens), output_tokens=sum(output_tokens), total_tokens=sum(total_tokens) by process_id
 | join kind=leftouter (
     customEvents
@@ -277,23 +208,11 @@ customEvents
     by FileType = file_type
 | order by TotalTokens desc
 
-// 17. Per-document token breakdown by step
-customEvents
-| where name == 'LLM_Agent_Token_Usage'
-| where timestamp > ago(7d)
-| extend agent = tostring(customDimensions['agent_name'])
-| extend process_id = tostring(customDimensions['process_id'])
-| extend input_tokens = toint(customDimensions['input_tokens'])
-| extend output_tokens = toint(customDimensions['output_tokens'])
-| extend total_tokens = toint(customDimensions['total_tokens'])
-| summarize
-    InputTokens = sum(input_tokens),
-    OutputTokens = sum(output_tokens),
-    TotalTokens = sum(total_tokens)
-    by process_id, Step = agent
-| order by process_id, TotalTokens desc
+// ============================================================
+// Processing Time Queries
+// ============================================================
 
-// 18. Step completion time (seconds from document start to step completion)
+// 11. Step completion time (seconds from document start to step completion)
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
@@ -316,7 +235,7 @@ customEvents
     by Step = agent
 | order by AvgCompletionTime desc
 
-// 19. OpenAI API call durations from dependencies table
+// 12. OpenAI API call durations from dependencies table
 dependencies
 | where timestamp > ago(7d)
 | where target has "openai" or name has "chat" or type == "HTTP" or name has "openai"
@@ -332,7 +251,7 @@ dependencies
 | order by TotalCalls desc
 | take 10
 
-// 20. Per-document step timeline
+// 13. Per-document step timeline
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
@@ -349,7 +268,7 @@ customEvents
 | project timestamp, process_id, Step=agent, StepCompletedAtSeconds=StepCompletedAt
 | order by process_id, timestamp asc
 
-// 21. Total document processing time (first to last step)
+// 14. Total document processing time (first to last step)
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(7d)
@@ -363,12 +282,34 @@ customEvents
     P90Seconds = round(percentile(TotalSeconds, 90), 2),
     MaxSeconds = round(max(TotalSeconds), 2)
 
-// 21. Daily processing volume with token costs
+// ============================================================
+// Percentiles & Trends
+// ============================================================
+
+// 15. Token usage percentiles per document
+customEvents
+| where name == 'LLM_Agent_Token_Usage'
+| where timestamp > ago(7d)
+| extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
+| extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize total_tokens=max(total_tokens) by agent, process_id
+| summarize total_tokens=sum(total_tokens) by process_id
+| summarize
+    p50 = percentile(total_tokens, 50),
+    p90 = percentile(total_tokens, 90),
+    p95 = percentile(total_tokens, 95),
+    p99 = percentile(total_tokens, 99),
+    Max = max(total_tokens)
+
+// 16. Daily processing volume with token usage
 customEvents
 | where name == 'LLM_Agent_Token_Usage'
 | where timestamp > ago(30d)
 | extend process_id = tostring(customDimensions['process_id'])
+| extend agent = tostring(customDimensions['agent_name'])
 | extend total_tokens = toint(customDimensions['total_tokens'])
+| summarize total_tokens=max(total_tokens), timestamp=min(timestamp) by agent, process_id
 | summarize total_tokens=sum(total_tokens), timestamp=min(timestamp) by process_id
 | summarize
     DocumentsProcessed = count(),