Kusto Queries on AKS Clusters

Sun, 25 Apr 2021 19:40:55 +0000

Kusto query language can be used to get insights into Azure Kubernetes Service (AKS) clusters. Container insights collects data from AKS clusters and forwards it to Log Analytics workspace, if enabled for a cluster. This data is available for querying in the Azure Monitor. Here is an example of how you can query the pods not in running state in specific namespaces.

KubePodInventory
| where Namespace in ("dv","test","prod")
| where ContainerStatus != "Running"
| where ContainerStatusReason !in ("", "Completed")
| distinct Namespace, Name

The following query includes the name of the AKS cluster and renders the output as a stacked bar chart.

KubePodInventory
| where Namespace in ("dv","test","prod")
| where ContainerStatus != "Running"
| where ContainerStatusReason !in ("", "Completed")
| distinct ClusterName, Namespace, Name
| summarize dcount(Name) by ClusterName, Namespace
| render columnchart kind=stacked100

You can include multiple AKS clusters in the scope in which this query is executed by clicking on [Select scope] hyperlink.

Create an Azure Dashboard panel with this output by clicking on [Pin to dashboard] button.

You can also execute this Kusto query directly using powershell.

$workspaceName = "DefaultWorkspace-6637b095-xxxx-xxxx-xxxx-xxxxxxxxxxx-EUS"
$workspaceRG = "defaultresourcegroup-eus"
$WorkspaceID = (Get-AzOperationalInsightsWorkspace -Name $workspaceName -ResourceGroupName $workspaceRG).CustomerID

$query = 'KubePodInventory | where Namespace in ("dv","test","prod") | where ContainerStatus != "Running" | where ContainerStatusReason !in ("", "Completed") | distinct ClusterName, Namespace, Name | summarize dcount(Name) by ClusterName, Namespace'

$result = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceID -Query $query -Timespan (New-TimeSpan -days 1)
$result.results

This allows you to include the results of your custom Kusto queries in any reports you might run using Azure Automation Runbooks.

Kusto on Ash Tewari

Kusto Queries on AKS Clusters