Restrict Log Analytics logging per deployment or container

4/5/2019

We've seen our Log Analytics costs spike and found that the ContainerLog table had grown drastically. This appears to be all stdout/stderr logs from the containers.

Is it possible to restrict logging to this table, at least for some deployments or containers, without disabling Log Analytics on the cluster? We still want performance logging and insights.

-- Dave New
azure-aks
azure-container-service
azure-kubernetes
azure-log-analytics

1 Answer

4/9/2019

AFAIK the stdout and stderr logs under ContainerLog table are basically the logs which we see when we manually run the command "kubectl logs " so it would be possible to restrict logging to ContainerLog table without disabling Log Analytics on the cluster by having the deployment file something like shown below which would write logs to logfile within the container.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: xxxxxxx
spec:
  selector:
    matchLabels:
      app: xxxxxxx
  template:
    metadata:
      labels:
        app: xxxxxxx
    spec:
      containers:
      - name: xxxxxxx
        image: xxxxxxx/xxxxxxx:latest
        command: ["sh", "-c",  "./xxxxxxx.sh &> /logfile"]

However, the best practice would be to send log messages to stdout for applications running in a container so the above process is not a preferrable way.

So you may create an alert when data collection is higher than expected as explained in this article and / or occasionally delete unwanted data as explained in this article by leveraging purge REST API (but make sure you are purging only unwanted data because the deletes in Log Analytics are non-reversible!).

Hope this helps!!

-- KrishnaG-MSFT
Source: StackOverflow