Azure Log Analytics/OMS - reconstruct container's log as raw text

11/3/2017

I have a kubernetes cluster setup with various pods all sending their container logs to Microsoft Operations Management. I find it impossible to find anything meaningful using log search because every line a container writes to the log is depicted as a separate row with numerous properties as seen below. If an error is thrown in a service for example there may be 30-50+ log entries in OMS that are not easy to read.

enter image description here

Is there a way, given a start and end date that I can re-construct the log as raw text without all the extra data shown in OMS?

e.g.

2017-11-03T11:51:14.607027272Z Record at (spanId=4d16b5de930235db, parentId=4d16b5de930235db, traceId=4d16b5de930235db): ServerSend()  
2017-11-03T11:51:14.607012071Z Record at (spanId=4d16b5de930235db, parentId=4d16b5de930235db, traceId=4d16b5de930235db): BinaryAnnotation(http.status_code="200")
...
...
-- TugboatCaptain
azure
kubernetes
logging

0 Answers