使用 ARM 模板格式的 Kusto 查询创建仪表板
Creating Dashboard using Kusto query in ARM Template format
希望你们都做得很好。
我正在研究针对 Azure Kubernetes 集群运行的 Kusto 查询。它工作正常，但当我尝试在 ARM 模板中合并以创建仪表板时，它抛出一个与“预期令牌 'RightParenthesis' 和实际 'Identifier'”相关的错误。
运行日志解析工作区查询如下：
let clusterName = 'AKS';
Perf
| where TimeGenerated > ago(2m)
| where ObjectName == "K8SNode"
| where CounterName == "cpuAllocatableNanoCores"
| where InstanceName contains clusterName
| summarize arg_max(TimeGenerated, *) by Computer
| summarize TotalCores=sum(CounterValue), x="join"
| join kind = inner (
KubePodInventory
| where TimeGenerated > ago(2m)
| where ClusterName contains clusterName
| summarize arg_max(TimeGenerated, *) by ContainerName
| project Name, ContainerName, Namespace
| join kind = inner (
Perf
| where TimeGenerated > ago(2m)
| where ObjectName == 'K8SContainer'
| where CounterName == 'cpuUsageNanoCores'
| where InstanceName contains clusterName
| extend ContainerNameParts = split(InstanceName, '/')
| extend ContainerNamePartCount = array_length(ContainerNameParts)
| extend PodUIDIndex = ContainerNamePartCount - 2, ContainerNameIndex = ContainerNamePartCount - 1
| extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], '/', ContainerNameParts[ContainerNameIndex])
| summarize arg_max(TimeGenerated, *) by ContainerName
| project ContainerName, CounterValue
)
on ContainerName
| project Name, Namespace, CounterValue
| summarize CoresPerNamespace=sum(CounterValue) by Namespace, x="join"
)
on x
| project UtcTime=now(), Namespace, CpuUtilizationPerNamespace=(CoresPerNamespace / TotalCores) * 100
==========================
后来我尝试将其合并到 ARM 模板中，但出现错误。
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"dashboardName": {
"defaultValue": "AKS-Temp-Dashboard",
"type": "String",
"metadata": {
"description": "DASHBOARD name for Azure kubernetes service cluster"
}
},
"resourceGroupName": {
"defaultValue": "aks-rg",
"type": "String",
"metadata": {
"description": "Azure resourceGroup name for Azure kubernetes service cluster"
}
},
"aksClusterName": {
"defaultValue": "aks",
"type": "String",
"metadata": {
"description": "Azure kubernetes service cluster name"
}
}
},
"variables": {
"dashboardName": "[concat(parameters('dashboardName'), '-DASHBOARD')]",
"aksResourceId": "[resourceId(parameters('resourceGroupName') , 'Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))]"
},
"resources": [
{
"properties": {
"lenses": {
"0": {
"order": 0,
"parts": {
"1": {
"position": {
"x": 0,
"y": 3,
"colSpan": 5,
"rowSpan": 3
},
"metadata": {
"inputs": [
{
"name": "resourceTypeMode",
"isOptional": true
},
{
"name": "ComponentId",
"isOptional": true
},
{
"name": "Scope",
"value": {
"resourceIds": [
"/subscriptions/7777t-a1ae-4ca9-89bc-gfgf7577575/resourcegroups/rg-eus/providers/microsoft.operationalinsights/workspaces/aks""
]
},
"isOptional": true
},
{
"name": "PartId",
"value": "4ae7fd78-1a4f-4025-a091-7d57e08d6822",
"isOptional": true
},
{
"name": "Version",
"value": "2.0",
"isOptional": true
},
{
"name": "TimeRange",
"isOptional": true
},
{
"name": "DashboardId",
"isOptional": true
},
{
"name": "DraftRequestParameters",
"isOptional": true
},
{
"name": "Query",
"value": "[concat('let clustername = \"', parameters('aksClusterName'), '\"; Perf\n| where TimeGenerated > ago(2m)\n| where ObjectName == \"K8SNode\" \n| where CounterName == \"cpuAllocatableNanoCores\" \n| where InstanceName contains clusterName\n| summarize arg_max(TimeGenerated, *) by Computer\n| summarize TotalCores=sum(CounterValue), x=\"join\"\n| join kind = inner (\n KubePodInventory\n | where TimeGenerated > ago(2m)\n | where ClusterName contains clusterName\n | summarize arg_max(TimeGenerated, *) by ContainerName\n | project Name, ContainerName, Namespace\n | join kind = inner (\n Perf\n | where TimeGenerated > ago(2m)\n | where ObjectName == 'K8SContainer'\n | where CounterName == 'cpuUsageNanoCores'\n | where InstanceName contains clusterName\n | extend ContainerNameParts = split(InstanceName, '/')\n | extend ContainerNamePartCount = array_length(ContainerNameParts) \n | extend PodUIDIndex = ContainerNamePartCount - 2, ContainerNameIndex = ContainerNamePartCount - 1 \n | extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], '/', ContainerNameParts[ContainerNameIndex])\n | summarize arg_max(TimeGenerated, *) by ContainerName\n | project ContainerName, CounterValue\n )\n on ContainerName\n | project Name, Namespace, CounterValue\n | summarize CoresPerNamespace=sum(CounterValue) by Namespace, x=\"join\"\n )\n on x\n| project UtcTime=now(), Namespace, CpuUtilizationPerNamespace=(CoresPerNamespace / TotalCores) * 100\n\n ')]",
"isOptional": true
},
{
"name": "ControlType",
"value": "FrameControlChart",
"isOptional": true
},
{
"name": "SpecificChart",
"value": "StackedColumn",
"isOptional": true
},
{
"name": "PartTitle",
"value": "Analytics",
"isOptional": true
},
{
"name": "PartSubTitle",
"value": "gaks-la1",
"isOptional": true
},
{
"name": "Dimensions",
"value": {
"xAxis": {
"name": "UtcTime",
"type": "datetime"
},
"yAxis": [
{
"name": "CpuUtilizationPerNamespace",
"type": "real"
}
],
"splitBy": [
{
"name": "Namespace",
"type": "string"
}
],
"aggregation": "Sum"
},
"isOptional": true
},
{
"name": "LegendOptions",
"value": {
"isEnabled": true,
"position": "Bottom"
},
"isOptional": true
},
{
"name": "IsQueryContainTimeRange",
"value": true,
"isOptional": true
}
],
"type": "Extension/Microsoft_OperationsManagementSuite_Workspace/PartType/LogsDashboardPart",
"settings": {}
}
}
}
}
},
"metadata": {
"model": {}
}
},
"name": "[variables('dashboardName')]",
"type": "Microsoft.Portal/dashboards",
"location": "[resourceGroup().location]",
"tags": {
"hidden-title": "AKS-Monitoring-Dashboard"
},
"apiVersion": "2015-08-01-preview"
}
]
}
请帮我解决这个问题。
注意：对我来说，它看起来 concat() 函数产生了一个问题。
下面找一张错误截图：
注意： 似乎 Concat() 函数设置不正确。
***** 在经过一番努力后添加更新 运行 查询以便最终用户可以寻求帮助 *****
"[concat('let clustername = \"', parameters('aksClusterName'), '\"; Perf \r\n| where TimeGenerated > ago(2m) \r\n| where ObjectName == \"K8SNode\" \r\n| where CounterName == \"cpuAllocatableNanoCores\" \r\n| where InstanceName contains clustername \r\n| summarize arg_max(TimeGenerated, *) by Computer \r\n| summarize TotalCores=sum(CounterValue), x=''join'' \r\n| join kind = inner (\r\n KubePodInventory \r\n | where TimeGenerated > ago(2m) \r\n | where ClusterName contains clustername \r\n | summarize arg_max(TimeGenerated, *) by ContainerName \r\n | project Name, ContainerName, Namespace \r\n | join kind = inner (\r\n Perf \r\n | where TimeGenerated > ago(2m) \r\n | where ObjectName == ''K8SContainer'' \r\n | where CounterName == ''cpuUsageNanoCores'' \r\n | where InstanceName contains clustername \r\n | extend ContainerNameParts = split(InstanceName, ''/'') \r\n | extend ContainerNamePartCount = array_length(ContainerNameParts) \r\n | extend PodUIDIndex = ContainerNamePartCount - 2 \r\n| extend ContainerNameIndex = ContainerNamePartCount - 1 \r\n | extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], ''/'', ContainerNameParts[ContainerNameIndex]) \r\n | summarize arg_max(TimeGenerated, *) by ContainerName\r\n | project ContainerName, CounterValue\r\n )\r\n on ContainerName\r\n | project Name, Namespace, CounterValue\r\n | summarize CoresPerNamespace=sum(CounterValue) by Namespace, x=''join''\r\n )\r\n on x \r\n| project UtcTime=now(), Namespace, CpuUtilizationPerNamespace=(CoresPerNamespace / TotalCores) * 100')]"
在您的 KQL 查询中，您有没有转义的撇号（例如 where CounterName == 'cpuUsageNanoCores'\n）。 ARM 将它们视为字符串的和，并需要逗号和 concat 函数的另一个参数，因此会出现错误。 AFAIR 你用另一个撇号转义了：''.
希望你们都做得很好。 我正在研究针对 Azure Kubernetes 集群运行的 Kusto 查询。它工作正常，但当我尝试在 ARM 模板中合并以创建仪表板时，它抛出一个与“预期令牌 'RightParenthesis' 和实际 'Identifier'”相关的错误。
运行日志解析工作区查询如下：
let clusterName = 'AKS';
Perf
| where TimeGenerated > ago(2m)
| where ObjectName == "K8SNode"
| where CounterName == "cpuAllocatableNanoCores"
| where InstanceName contains clusterName
| summarize arg_max(TimeGenerated, *) by Computer
| summarize TotalCores=sum(CounterValue), x="join"
| join kind = inner (
KubePodInventory
| where TimeGenerated > ago(2m)
| where ClusterName contains clusterName
| summarize arg_max(TimeGenerated, *) by ContainerName
| project Name, ContainerName, Namespace
| join kind = inner (
Perf
| where TimeGenerated > ago(2m)
| where ObjectName == 'K8SContainer'
| where CounterName == 'cpuUsageNanoCores'
| where InstanceName contains clusterName
| extend ContainerNameParts = split(InstanceName, '/')
| extend ContainerNamePartCount = array_length(ContainerNameParts)
| extend PodUIDIndex = ContainerNamePartCount - 2, ContainerNameIndex = ContainerNamePartCount - 1
| extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], '/', ContainerNameParts[ContainerNameIndex])
| summarize arg_max(TimeGenerated, *) by ContainerName
| project ContainerName, CounterValue
)
on ContainerName
| project Name, Namespace, CounterValue
| summarize CoresPerNamespace=sum(CounterValue) by Namespace, x="join"
)
on x
| project UtcTime=now(), Namespace, CpuUtilizationPerNamespace=(CoresPerNamespace / TotalCores) * 100
==========================
后来我尝试将其合并到 ARM 模板中，但出现错误。
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"dashboardName": {
"defaultValue": "AKS-Temp-Dashboard",
"type": "String",
"metadata": {
"description": "DASHBOARD name for Azure kubernetes service cluster"
}
},
"resourceGroupName": {
"defaultValue": "aks-rg",
"type": "String",
"metadata": {
"description": "Azure resourceGroup name for Azure kubernetes service cluster"
}
},
"aksClusterName": {
"defaultValue": "aks",
"type": "String",
"metadata": {
"description": "Azure kubernetes service cluster name"
}
}
},
"variables": {
"dashboardName": "[concat(parameters('dashboardName'), '-DASHBOARD')]",
"aksResourceId": "[resourceId(parameters('resourceGroupName') , 'Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))]"
},
"resources": [
{
"properties": {
"lenses": {
"0": {
"order": 0,
"parts": {
"1": {
"position": {
"x": 0,
"y": 3,
"colSpan": 5,
"rowSpan": 3
},
"metadata": {
"inputs": [
{
"name": "resourceTypeMode",
"isOptional": true
},
{
"name": "ComponentId",
"isOptional": true
},
{
"name": "Scope",
"value": {
"resourceIds": [
"/subscriptions/7777t-a1ae-4ca9-89bc-gfgf7577575/resourcegroups/rg-eus/providers/microsoft.operationalinsights/workspaces/aks""
]
},
"isOptional": true
},
{
"name": "PartId",
"value": "4ae7fd78-1a4f-4025-a091-7d57e08d6822",
"isOptional": true
},
{
"name": "Version",
"value": "2.0",
"isOptional": true
},
{
"name": "TimeRange",
"isOptional": true
},
{
"name": "DashboardId",
"isOptional": true
},
{
"name": "DraftRequestParameters",
"isOptional": true
},
{
"name": "Query",
"value": "[concat('let clustername = \"', parameters('aksClusterName'), '\"; Perf\n| where TimeGenerated > ago(2m)\n| where ObjectName == \"K8SNode\" \n| where CounterName == \"cpuAllocatableNanoCores\" \n| where InstanceName contains clusterName\n| summarize arg_max(TimeGenerated, *) by Computer\n| summarize TotalCores=sum(CounterValue), x=\"join\"\n| join kind = inner (\n KubePodInventory\n | where TimeGenerated > ago(2m)\n | where ClusterName contains clusterName\n | summarize arg_max(TimeGenerated, *) by ContainerName\n | project Name, ContainerName, Namespace\n | join kind = inner (\n Perf\n | where TimeGenerated > ago(2m)\n | where ObjectName == 'K8SContainer'\n | where CounterName == 'cpuUsageNanoCores'\n | where InstanceName contains clusterName\n | extend ContainerNameParts = split(InstanceName, '/')\n | extend ContainerNamePartCount = array_length(ContainerNameParts) \n | extend PodUIDIndex = ContainerNamePartCount - 2, ContainerNameIndex = ContainerNamePartCount - 1 \n | extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], '/', ContainerNameParts[ContainerNameIndex])\n | summarize arg_max(TimeGenerated, *) by ContainerName\n | project ContainerName, CounterValue\n )\n on ContainerName\n | project Name, Namespace, CounterValue\n | summarize CoresPerNamespace=sum(CounterValue) by Namespace, x=\"join\"\n )\n on x\n| project UtcTime=now(), Namespace, CpuUtilizationPerNamespace=(CoresPerNamespace / TotalCores) * 100\n\n ')]",
"isOptional": true
},
{
"name": "ControlType",
"value": "FrameControlChart",
"isOptional": true
},
{
"name": "SpecificChart",
"value": "StackedColumn",
"isOptional": true
},
{
"name": "PartTitle",
"value": "Analytics",
"isOptional": true
},
{
"name": "PartSubTitle",
"value": "gaks-la1",
"isOptional": true
},
{
"name": "Dimensions",
"value": {
"xAxis": {
"name": "UtcTime",
"type": "datetime"
},
"yAxis": [
{
"name": "CpuUtilizationPerNamespace",
"type": "real"
}
],
"splitBy": [
{
"name": "Namespace",
"type": "string"
}
],
"aggregation": "Sum"
},
"isOptional": true
},
{
"name": "LegendOptions",
"value": {
"isEnabled": true,
"position": "Bottom"
},
"isOptional": true
},
{
"name": "IsQueryContainTimeRange",
"value": true,
"isOptional": true
}
],
"type": "Extension/Microsoft_OperationsManagementSuite_Workspace/PartType/LogsDashboardPart",
"settings": {}
}
}
}
}
},
"metadata": {
"model": {}
}
},
"name": "[variables('dashboardName')]",
"type": "Microsoft.Portal/dashboards",
"location": "[resourceGroup().location]",
"tags": {
"hidden-title": "AKS-Monitoring-Dashboard"
},
"apiVersion": "2015-08-01-preview"
}
]
}
请帮我解决这个问题。 注意：对我来说，它看起来 concat() 函数产生了一个问题。
下面找一张错误截图：
注意： 似乎 Concat() 函数设置不正确。
***** 在经过一番努力后添加更新 运行 查询以便最终用户可以寻求帮助 *****
"[concat('let clustername = \"', parameters('aksClusterName'), '\"; Perf \r\n| where TimeGenerated > ago(2m) \r\n| where ObjectName == \"K8SNode\" \r\n| where CounterName == \"cpuAllocatableNanoCores\" \r\n| where InstanceName contains clustername \r\n| summarize arg_max(TimeGenerated, *) by Computer \r\n| summarize TotalCores=sum(CounterValue), x=''join'' \r\n| join kind = inner (\r\n KubePodInventory \r\n | where TimeGenerated > ago(2m) \r\n | where ClusterName contains clustername \r\n | summarize arg_max(TimeGenerated, *) by ContainerName \r\n | project Name, ContainerName, Namespace \r\n | join kind = inner (\r\n Perf \r\n | where TimeGenerated > ago(2m) \r\n | where ObjectName == ''K8SContainer'' \r\n | where CounterName == ''cpuUsageNanoCores'' \r\n | where InstanceName contains clustername \r\n | extend ContainerNameParts = split(InstanceName, ''/'') \r\n | extend ContainerNamePartCount = array_length(ContainerNameParts) \r\n | extend PodUIDIndex = ContainerNamePartCount - 2 \r\n| extend ContainerNameIndex = ContainerNamePartCount - 1 \r\n | extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], ''/'', ContainerNameParts[ContainerNameIndex]) \r\n | summarize arg_max(TimeGenerated, *) by ContainerName\r\n | project ContainerName, CounterValue\r\n )\r\n on ContainerName\r\n | project Name, Namespace, CounterValue\r\n | summarize CoresPerNamespace=sum(CounterValue) by Namespace, x=''join''\r\n )\r\n on x \r\n| project UtcTime=now(), Namespace, CpuUtilizationPerNamespace=(CoresPerNamespace / TotalCores) * 100')]"
在您的 KQL 查询中，您有没有转义的撇号（例如 where CounterName == 'cpuUsageNanoCores'\n）。 ARM 将它们视为字符串的和，并需要逗号和 concat 函数的另一个参数，因此会出现错误。 AFAIR 你用另一个撇号转义了：''.