Azure Kubernetes Log - KQL Query Examples

Below are some useful example of KQL which we use to locate issues within an Azure Kubernetes Log Instance.

Find any entry in the logs within the last hour that mentions an error

let startTimestamp = ago(1hr);
KubePodInventory
| where TimeGenerated > startTimestamp
| project ContainerID, PodName=Name
| distinct ContainerID, PodName
| join
(
ContainerLog
| where TimeGenerated > startTimestamp
)
on ContainerID
| where LogEntry contains "ERROR"

Find any the payload of a specific manifest within the last 40 hours

let startTimestamp = ago(40hr);
KubePodInventory
| where TimeGenerated > startTimestamp
| project ContainerID, PodName=Name
| distinct ContainerID, PodName
| join
(
ContainerLog
| where TimeGenerated > startTimestamp
)
on ContainerID
| where LogEntry == "MANIFESTNAME" and LogEntry contains "Payload"

Find all payloads from any manifest that contains ENQ_

let startTimestamp = ago(40hr);
KubePodInventory
| where TimeGenerated > startTimestamp
| project ContainerID, PodName=Name
| distinct ContainerID, PodName
| join
(
ContainerLog
| where TimeGenerated > startTimestamp
)
on ContainerID
| where LogEntry contains "ENQ_" and LogEntry contains "Payload"

Find a specific set of log entries that are connected to a response ID

let startTimestamp = ago(40hr);
KubePodInventory
| where TimeGenerated > startTimestamp
| project ContainerID, PodName=Name
| distinct ContainerID, PodName
| join
(
ContainerLog
| where TimeGenerated > startTimestamp
)
on ContainerID
| where LogEntry contains "62441858-07ae-4a7c-8b3e-f7d34ab11988-0"

Find entries that are related to a communications disruption

let startTimestamp = ago(40hr);
KubePodInventory
| where TimeGenerated > startTimestamp
| project ContainerID, PodName=Name
| distinct ContainerID, PodName
| join
(
ContainerLog
| where TimeGenerated > startTimestamp
)
on ContainerID
| where LogEntry contains "establishing a connection to SQL Server."

Find all the entries from Apigator where the error is not null for a specific tenant

let startTimestamp = ago(1hr);
KubePodInventory
| where TimeGenerated > startTimestamp
| project ContainerID, PodName=Name
| distinct ContainerID, PodName
| join
(
ContainerLog
| where TimeGenerated > startTimestamp
)
on ContainerID
| where PodName contains "apigator"
| where isnotempty(parse_json(tostring(parse_json(LogEntry).fields)).ErrorMessage)
| where parse_json(tostring(parse_json(LogEntry).fields)).RequestingFirmId == 9