如何在Azure Log Analytics中获取按命名空间过滤、按服务分组的CPU与内存使用率时序图表？

Let's break down what's missing in your original query and fix it to get the time-series data you need, plus add memory usage tracking for complete visibility.

Key Issues in the Original Query #

• Ambiguous ServiceName: Your query references ServiceName but doesn't define where it comes from. KubePodInventory doesn't have a built-in ServiceName field—you'll need to extract it from your pod's labels (like the app or service label that maps to your Kubernetes service).
• Unqualified Time Field: After joining KubePodInventory and Perf, there are two TimeGenerated fields. You need to explicitly reference Perf.TimeGenerated to bucket time based on when the metric was actually collected.
• Unfiltered Join: Joining without a time range can lead to slow queries and inaccurate data associations. Adding a time filter will speed things up and improve reliability.

Corrected KQL Query (CPU + Memory) #

// Define your target namespace and analysis time range
let targetNamespace = "your-namespace";
let timeRange = ago(1h); // Adjust to your desired window (e.g., ago(6h), ago(1d))

// Get pod inventory with service name extracted from labels
KubePodInventory
| where Namespace == targetNamespace
| where TimeGenerated >= timeRange
// Extract ServiceName from pod labels - update the label key to match your setup
| extend ServiceName = tostring(Labels['app']) 
| extend InstanceName = strcat(ClusterId, '/', ContainerName)
// Join with Perf metrics, filtering to only relevant container metrics
| join kind=inner (
    Perf
    | where TimeGenerated >= timeRange
    | where ObjectName == 'K8SContainer'
    | where CounterName in ('cpuUsageNanoCores', 'memoryRssBytes')
) on InstanceName
// Bucket time into 1-minute intervals and aggregate by service
| summarize 
    AvgCPUUsageCores = avg(CounterValue) / 1000000000,
    AvgMemoryUsageGB = avg(CounterValue) / 1024 / 1024 / 1024
    by 
        LogTime = bin(Perf.TimeGenerated, 1m),
        ServiceName,
        CounterName
// Pivot to have CPU and memory as separate columns for easier charting
| pivot(CounterName, any(AvgCPUUsageCores), any(AvgMemoryUsageGB))
| project LogTime, ServiceName, AvgCPUUsageCores, AvgMemoryUsageGB
| order by LogTime asc

Quick Adjustments for Your Environment #

• Service Name Extraction: Replace Labels['app'] with the actual label key your services use (e.g., Labels['service'] or Labels['app.kubernetes.io/name']). You can check your pod labels with KubePodInventory | where Namespace == targetNamespace | project Labels if you're unsure.
• Memory Metric: We use memoryRssBytes for resident set size memory usage—swap to memoryWorkingSetBytes if that's the metric you need instead.
• Time Granularity: Change bin(Perf.TimeGenerated, 1m) to 5m or 15m if you want coarser time buckets.

Generating the Time-Series Chart #

Once you run the corrected query in Azure Monitor Logs:

1. Switch to the Chart tab (next to the Table view).
2. Select Line chart as the chart type.
3. Set the X-axis to LogTime.
4. Add AvgCPUUsageCores and AvgMemoryUsageGB to the Y-axis.
5. Use ServiceName as the Series to group lines by each service.

This will give you a clear, interactive view of how average CPU and memory usage changes over time for each service in your namespace.

内容的提问来源于stack exchange，提问作者anoopjohn