KQL Query Packs¶

Accelerate your investigations with reusable Kusto Query Language (KQL) patterns. These query packs provide a starting point for gathering evidence across your Azure Kubernetes Service clusters before you move into deep playbook analysis.

flowchart TD
    QP[Query Packs] --> WL[Workloads]
    QP --> ND[Nodes]
    QP --> LE[Logs & Events]
    QP --> CR[Correlation]
    QP --> CP[Control Plane]
    QP --> ST[Storage]
    WL --> PR[Pod Restarts]
    ND --> RP[Resource Pressure]
    LE --> CE[Container Errors]
    CR --> IT[Incident Timeline]
    CP --> AP[API Server Health]
    ST --> PV[PVC and CSI]

Categories¶

Prerequisites¶

Before using these queries, ensure your cluster has the following configured:

• Container insights: Enabled via the portal, Azure CLI, or Terraform.
• Log Analytics Workspace: The destination for cluster logs and metrics.
• Permissions: You need at least the Log Analytics Reader role on the workspace.

You can run these queries directly in the Azure Portal's Logs blade or via the Azure CLI using:

az monitor log-analytics query --workspace <workspace-id> --analytics-query "KubePodInventory | take 10"

Usage Notes¶

• Time Windows: Most queries use ago(1h) by default. Adjust this window based on when your incident occurred.
• Table Availability: If a query returns no results, confirm that the relevant table (like ContainerLogV2) is enabled in your data collection settings.
• Case Sensitivity: KQL is case-sensitive for string comparisons. Use contains for case-insensitive matches if you're unsure.
• Projecting Columns: These queries use project to keep results clean. Remove the project line if you need to see all available data fields.

See Also¶

• Troubleshooting Methodology
• Decision Tree
• Playbooks
• Troubleshooting Index

Sources¶

• Container insights overview
• Query logs from Container insights
• Kusto Query Language (KQL) overview