<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Log-Analytics on Ash Tewari</title><link>https://www.tewari.info/tag/log-analytics/</link><description>Recent content in Log-Analytics on Ash Tewari</description><generator>Hugo</generator><language>en-US</language><lastBuildDate>Sun, 25 Apr 2021 19:40:55 +0000</lastBuildDate><atom:link href="https://www.tewari.info/tag/log-analytics/feed.xml" rel="self" type="application/rss+xml"/><item><title>Kusto Queries on AKS Clusters</title><link>https://www.tewari.info/2021/04/25/kusto-queries-on-aks-clusters/</link><pubDate>Sun, 25 Apr 2021 19:40:55 +0000</pubDate><guid isPermaLink="false">https://www.tewari.info/?p=1279</guid><description>&lt;p&gt;&lt;a href="https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/"&gt;Kusto&lt;/a&gt; query language can be used to get &lt;a href="https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-log-search"&gt;insights&lt;/a&gt; into Azure Kubernetes Service (&lt;a href="https://azure.microsoft.com/en-us/services/kubernetes-service/"&gt;AKS&lt;/a&gt;) clusters. &lt;a href="https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-overview"&gt;Container insights&lt;/a&gt; collects data from AKS clusters and forwards it to &lt;a href="https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial"&gt;Log Analytics&lt;/a&gt; workspace, if enabled for a cluster. This data is available for querying in the &lt;a href="https://docs.microsoft.com/en-us/azure/azure-monitor/logs/data-platform-logs"&gt;Azure Monitor&lt;/a&gt;. Here is an example of how you can query the pods not in running state in specific namespaces.&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"&gt;&lt;code class="language-fallback" data-lang="fallback"&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;KubePodInventory
&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;| where Namespace in (&amp;#34;dv&amp;#34;,&amp;#34;test&amp;#34;,&amp;#34;prod&amp;#34;)
&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;| where ContainerStatus != &amp;#34;Running&amp;#34;
&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;| where ContainerStatusReason !in (&amp;#34;&amp;#34;, &amp;#34;Completed&amp;#34;)
&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;| distinct Namespace, Name
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;figure&gt;
&lt;img loading="lazy" src="https://www.tewari.info/wp-content/image-7.png"
alt="Log Analytics query results listing pods not in running state by namespace"/&gt;
&lt;/figure&gt;
&lt;p&gt;The following query includes the name of the AKS cluster and renders the output as a stacked bar chart.&lt;/p&gt;</description></item></channel></rss>