What are the ways I can see AKS logs which is exported to Azure storage?

Question

Hi Team,

We have created one AKS in Azure and performed below steps for storing the Container logs:

1. Created Log Analytics Workspace.
2. In AKS >Diagnostic setting>Add diagnostic setting (added the info of above created Log Analytics Workspace)
3. Created storage account
4. Log Analytics > Data export > New export rule

After that we are able to see logs but in sperate folders (y=2023 / m=07 / d=13 / h=01 / m=10).
Is there any way we can see these logs together like we can see in AKS>Logs>Table section(KQL)?
Also please let us know other possible ways to view stored(that we exported to Azure storage) logs in Log Analytics or locally.

Thanks in advanced.

Answer 1

@Rajan Gahlout

Yes, you can view the logs that you have exported to Azure storage together in a single table using Kusto Query Language (KQL) in Log Analytics. I recommend checking out the tutorial page for a walk through. For example, you can use a query like this to fetch logs from different folders:

union withsource=folder *
| where folder startswith "y=2023/m=07/d=13"
| project TimeGenerated, folder, LogMessage
| order by TimeGenerated desc

Apart from this, you can also use Azure Storage Explorer to view the logs stored in the storage account. Azure Storage Explorer is a free, standalone app that you can use to work with Azure Storage data.

To view the logs locally, you can download them from the storage account using Azure Storage Explorer or any other tool that you prefer, and then open them in a log viewer or editor such as Notepad++, Visual Studio Code, or Log Parser Studio.

Hope this helps! Let me know if you have anymore questions.

---

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!

Answer 2

Thanks for the response, but above command didin't helped me.
Can you please let me know what we need to give instead of folder in my case?
or we need to execute same below command:

union withsource=folder *

| where folder startswith "y=2023/m=07/d=13"

| project TimeGenerated, folder, LogMessage

| order by TimeGenerated desc