Kusto query language can be used to get insights into Azure Kubernetes Service (AKS) clusters. Container insights collects data from AKS clusters and forwards it to Log Analytics workspace, if enabled for a cluster. This data is available for querying in the Azure Monitor. Here is an example of how you can query the pods not in running state in specific namespaces.
KubePodInventory
| where Namespace in ("dv","test","prod")
| where ContainerStatus != "Running"
| where ContainerStatusReason !in ("", "Completed")
| distinct Namespace, Name ![Run
Time range : Last 24 hours
E] Save v
14 Share v
1
2
3
4
5
KubePodInventory
I where Namespaceän ('dv', 'test', 'prod')
I where ContainerStatusu !=
"Running"
I where ContainerStatusReasone ! in ('I", "Completed")
I distinct Namespace, Name
Results Chart
@ Display time (UTC+OO:OO) v
Columns v
Completed. Showing results from the last 24 hours.
>
Namespace
dv
prod
Y Name Y
app2
app2](https://www.tewari.info/wp-content/image-7.png)
The following query includes the name of the AKS cluster and renders the output as a stacked bar chart.
KubePodInventory
| where Namespace in ("dv","test","prod")
| where ContainerStatus != "Running"
| where ContainerStatusReason !in ("", "Completed")
| distinct ClusterName, Namespace, Name
| summarize dcount(Name) by ClusterName, Namespace
| render columnchart kind=stacked100 ![Run
Time range : Last 24 hours
E] Save v
14 Share v
+ New alert rule
Export v
Pin to dashboard
1
2
3
4
5
6
7
8
KubePodInventory
I where Namespace in ('dv', 'test', 'prod')
I where ContainerStatus ! =
"Running"
I where ContainerStatusReason ! in ('I", "Completed")
I distinct ClusterName, Namespace, Name
summarize dcount(Name) by ClusterName, Namespace
render columnchart kind=stacked100
Results
Chart
@ Display time (UTC+OO:OO) v
Completed. Showing results from the last 24 hours.
00:00.7
2 records
z
o
100
50
dv
O
aksdemol
ClusterName
prod
Activate Windows
Go to Settings to activate Windows.](https://www.tewari.info/wp-content/image-8-1024x582.png)
You can include multiple AKS clusters in the scope in which this query is executed by clicking on [Select scope] hyperlink.
Create an Azure Dashboard panel with this output by clicking on [Pin to dashboard] button.
You can also execute this Kusto query directly using powershell.
$workspaceName = "DefaultWorkspace-6637b095-xxxx-xxxx-xxxx-xxxxxxxxxxx-EUS"
$workspaceRG = "defaultresourcegroup-eus"
$WorkspaceID = (Get-AzOperationalInsightsWorkspace -Name $workspaceName -ResourceGroupName $workspaceRG).CustomerID
$query = 'KubePodInventory | where Namespace in ("dv","test","prod") | where ContainerStatus != "Running" | where ContainerStatusReason !in ("", "Completed") | distinct ClusterName, Namespace, Name | summarize dcount(Name) by ClusterName, Namespace'
$result = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceID -Query $query -Timespan (New-TimeSpan -days 1)
$result.results This allows you to include the results of your custom Kusto queries in any reports you might run using Azure Automation Runbooks.
