Log Querying

---

KQL query examples for querying application logs from ContainerLogV2 in Log Analytics.

---

Where to Run Queries

1. Go to Azure Portal → Log Analytics Workspace → Logs
2. Or go to AKS cluster → Monitoring → Logs

All queries below use the **ContainerLogV2** table.

---

View Latest Container Logs

ContainerLogV2
| where TimeGenerated > ago(15m)
| project TimeGenerated, ContainerName, PodName, PodNamespace, LogMessage, LogSource
| order by TimeGenerated desc
| take 50

---

Filter Logs for ness-app

ContainerLogV2
| where TimeGenerated > ago(1h)
| where PodNamespace == "default"
| where PodName startswith "ness-app"
| project TimeGenerated, PodName, ContainerName, LogMessage, LogSource
| order by TimeGenerated desc

---

Filter by Namespace

ContainerLogV2
| where TimeGenerated > ago(1h)
| where PodNamespace == "default"
| project TimeGenerated, PodName, LogMessage, LogSource
| order by TimeGenerated desc

---

Show Only Errors (stderr)

ContainerLogV2
| where TimeGenerated > ago(1h)
| where LogSource == "stderr"
| project TimeGenerated, PodName, PodNamespace, ContainerName, LogMessage
| order by TimeGenerated desc

---

Error Count by Pod (Last 24h)

ContainerLogV2
| where TimeGenerated > ago(24h)
| where LogSource == "stderr"
| summarize ErrorCount = count() by PodName, PodNamespace, bin(TimeGenerated, 1h)
| order by ErrorCount desc

---

Log Volume by Namespace

ContainerLogV2
| where TimeGenerated > ago(24h)
| summarize LogCount = count(), SizeMB = sum(string_size(LogMessage)) / 1048576.0
  by PodNamespace
| order by LogCount desc

---

Search Logs for a Keyword

ContainerLogV2
| where TimeGenerated > ago(1h)
| where LogMessage contains "exception"
| project TimeGenerated, PodName, PodNamespace, LogMessage, LogSource
| order by TimeGenerated desc
| take 100

---

Logs from a Specific Container

ContainerLogV2
| where TimeGenerated > ago(1h)
| where ContainerName == "ness-app"
| project TimeGenerated, PodName, LogMessage, LogSource
| order by TimeGenerated desc

---

Pod Restart Correlation

Find logs just before a pod restarted:

let restartedPods = KubePodInventory
| where TimeGenerated > ago(24h)
| where ContainerRestartCount > 0
| distinct PodName, PodNamespace;
ContainerLogV2
| where TimeGenerated > ago(24h)
| where LogSource == "stderr"
| join kind=inner restartedPods on PodName, PodNamespace
| project TimeGenerated, PodName, PodNamespace, LogMessage
| order by TimeGenerated desc

---

Log Count Over Time (Timechart)

ContainerLogV2
| where TimeGenerated > ago(24h)
| where PodNamespace == "default"
| summarize Count = count() by bin(TimeGenerated, 15m), LogSource
| render timechart

---

ContainerLogV2 Schema Quick Reference

Field	Type	Description
TimeGenerated	datetime	UTC timestamp
Computer	string	Node name
ContainerId	string	Container runtime ID
ContainerName	string	Container name from pod spec
PodName	string	Pod name
PodNamespace	string	Kubernetes namespace
LogMessage	string	Log content (stdout/stderr)
LogSource	string	stdout or stderr
KubernetesMetadata	dynamic	JSON — labels, annotations, owner refs