Differences between revisions 1 and 2

k8s/Azure/KustoLogs

Queries in Azure Kusto Query language.

Find logs for specific pod/namespace

let _podInventory = ( KubePodInventory 
       | where Namespace has "MyNamespace-prd" 
       | where ContainerName has_any ('container1', 'container2' , 'container3' )
);
ContainerLog
| where TimeGenerated < ago(4d)
| join kind=inner _podInventory on $left.ContainerID == $right.ContainerID
| limit 5000
| project LogEntry, Name1, Namespace , ContainerName, TimeGenerated, ClusterId, PodRestartCount

-  ⇤ ← Revision 1 as of 2020-06-10 06:17:35 → 
  Size: 497
  Editor: PieterSmit
  Comment:
+   ← Revision 2 as of 2020-06-10 06:32:35 → ⇥
  Size: 539
  Editor: PieterSmit
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 7:
-let _podInventory = ( KubePodInventory | where Namespace contains "namespace-prd" | where ContainerName contains "MyContainerName" );
+let _podInventory = ( KubePodInventory 
       | where Namespace has "MyNamespace-prd"         | where ContainerName has_any ('container1', 'container2' , 'container3' )
);
-Line 9:
+Line 12:
-| where TimeGenerated < ago(7d)
+| where TimeGenerated < ago(4d)