如何更好地优化此 Kusto 查询以获取我的日志

Question

我有以下查询，我是运行并正在获取 Azure K8s 的日志，但生成日志需要几个小时，我希望有更好的方法来编写我已经编写的内容。一些 Kusto 专家可以在这里建议我如何提高性能吗？

AzureDiagnostics 
| where Category == 'kube-audit'
| where TimeGenerated between (startofday(datetime("2022-03-26")) .. endofday(datetime("2022-03-27"))) 
| where (strlen(log_s) >= 32000
and not(log_s has "aksService") 
and not(log_s has "system:serviceaccount:crossplane-system:crossplane")    
or strlen(log_s) < 32000
| extend op = parse_json(log_s) 
| where not(tostring(op.verb) in ("list", "get", "watch"))   
| where substring(tostring(op.responseStatus.code), 0, 1) == "2"
| where not(tostring(op.requestURI) in ("/apis/authorization.k8s.io/v1/selfsubjectaccessreviews"))
| extend user = op.user.username
| extend decision = tostring(parse_json(tostring(op.annotations)).["authorization.k8s.io/decision"])
| extend requestURI = tostring(op.requestURI)
| extend name = tostring(parse_json(tostring(op.objectRef)).name)
| extend namespace = tostring(parse_json(tostring(op.objectRef)).namespace)
| extend verb = tostring(op.verb)
| project TimeGenerated, SubscriptionId, ResourceId, namespace, name, requestURI, verb, decision, ['user']
| order by TimeGenerated asc

Answer 1

您可以尝试按以下方式开始查询。
请注意最后的附加条件。

AzureDiagnostics 
| where TimeGenerated between (startofday(datetime("2022-03-26")) .. endofday(datetime("2022-03-27"))) 
| where Category == 'kube-audit'
| where log_s hasprefix '"code":2'

我假设 code 是整数，如果是字符串，请使用以下（添加的限定符）

| where log_s has prefix '"code":"2'

如何更好地优化此 Kusto 查询以获取我的日志

How better I can optimize this Kusto Query to get my logs

kql

azure-log-analytics

azure-diagnostics