Workloads Query Pack¶
This query pack provides tools to investigate pod-level failures using Container insights inventory, events, and logs. These queries help identify unhealthy workloads and correlate failures with cluster events.
Queries¶
| Query | Focus | Tables |
|---|---|---|
| Pod Restarts | Elevated container restart counts | KubePodInventory |
| CrashLoopBackOff | Crash loop correlation with events/logs | KubePodInventory, KubeEvents, ContainerLogV2 |
| Pending Pods | Scheduling failures | KubePodInventory, KubeEvents |
Usage Notes¶
- Time range: Most queries use a default lookback window of 1 to 6 hours. Adjust
ago()values based on your incident timeline. - Filtering: Use
where Namespace == "your-namespace"to narrow results in large clusters. - Aggregation: Queries use
summarizeto group data by controller and pod name for easier analysis.