Container Logs on AKS
What Are Container Logs?
Container Logs is an Azure Monitor capability that collects stdout and stderr output from all containers running on an AKS cluster. It uses the Azure Monitor Agent (AMA), deployed as a managed DaemonSet in the `kube-system` namespace, to capture logs and send them to a Log Analytics Workspace.
Logs are stored in the ContainerLogV2 table — a structured schema that automatically enriches each log entry with Kubernetes metadata (pod name, namespace, node, container name, labels, and annotations) without any manual parsing or configuration.
How It Works
- Container Insights addon is enabled on the AKS cluster
- Azure deploys the AMA agent (
ama-logs) as a DaemonSet — one pod per node - AMA collects stdout/stderr from the container runtime on each node
- Logs are enriched with Kubernetes metadata and written to the ContainerLogV2 table in your Log Analytics Workspace
- Logs can be queried via KQL in the Azure Portal or exported to Event Hub / Storage via Diagnostic Settings
ContainerLogV2 Schema
| Field | Description |
|---|---|
TimeGenerated |
UTC timestamp of the log entry |
Computer |
Node name where the pod is running |
ContainerId |
Container runtime ID |
ContainerName |
Container name from the pod spec |
PodName |
Kubernetes pod name |
PodNamespace |
Kubernetes namespace |
LogMessage |
The actual log content (stdout/stderr output) |
LogSource |
stdout or stderr |
KubernetesMetadata |
JSON object containing labels, annotations, and owner references |
All metadata fields are populated **automatically** — no plugins or custom configuration required.
Cost Tiers
Container Insights supports two log tiers for the ContainerLogV2 table:
| Tier | Approx. Cost | Retention | Query Support | Best For |
|---|---|---|---|---|
| Analytics (default) | ~$2.76/GB | 30–730 days | Full KQL | Production, alerting, dashboards |
| Basic | ~$0.65/GB | 8 days (fixed) | Limited KQL | Dev/test, high-volume debug logs |
To switch to Basic tier:
az monitor log-analytics workspace table update \
--resource-group $RESOURCE_GROUP \
--workspace-name $LAW_NAME \
--name ContainerLogV2 \
--plan Basic \
--subscription $SUBSCRIPTION_ID
Prerequisites
- An existing AKS cluster
- An existing Resource Group
- Azure CLI v2.49+ with
aks-previewextension Microsoft.MonitorandMicrosoft.Insightsresource providers registered on the subscription