如何将AKS应用日志发送至Log Analytics工作区？配置后无日志排查

我已使用以下Terraform代码创建AKS集群：

resource "azurerm_virtual_network" "test" {
  name                = var.virtual_network_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = [var.virtual_network_address_prefix]

  subnet {
    name           = var.aks_subnet_name
    address_prefix = var.aks_subnet_address_prefix
  }

  tags = var.tags
}

data "azurerm_subnet" "kubesubnet" {
  name                 = var.aks_subnet_name
  virtual_network_name = azurerm_virtual_network.test.name
  resource_group_name  = azurerm_resource_group.rg.name
  depends_on           = [azurerm_virtual_network.test]
}

resource "azurerm_kubernetes_cluster" "k8s" {
  name       = var.aks_name
  location   = azurerm_resource_group.rg.location
  dns_prefix = var.aks_dns_prefix

  resource_group_name = azurerm_resource_group.rg.name

  http_application_routing_enabled = false

  linux_profile {
    admin_username = var.vm_user_name

    ssh_key {
      key_data = file(var.public_ssh_key_path)
    }
  }

  default_node_pool {
    name            = "agentpool"
    node_count      = var.aks_agent_count
    vm_size         = var.aks_agent_vm_size
    os_disk_size_gb = var.aks_agent_os_disk_size
    vnet_subnet_id  = data.azurerm_subnet.kubesubnet.id
  }

  service_principal {
    client_id     = local.client_id
    client_secret = local.client_secret
  }

  network_profile {
    network_plugin     = "azure"
    dns_service_ip     = var.aks_dns_service_ip
    docker_bridge_cidr = var.aks_docker_bridge_cidr
    service_cidr       = var.aks_service_cidr
  }

  # Enabled the cluster configuration to the Azure kubernets with RBAC
  azure_active_directory_role_based_access_control { 
    managed                     = var.azure_active_directory_role_based_access_control_managed
    admin_group_object_ids      = var.active_directory_role_based_access_control_admin_group_object_ids
    azure_rbac_enabled          = var.azure_rbac_enabled
  }

  oms_agent {
    log_analytics_workspace_id  = module.log_analytics_workspace[0].id
  }

  timeouts {
    create = "20m"
    delete = "20m"
  }  

  depends_on = [data.azurerm_subnet.kubesubnet,module.log_analytics_workspace]
  tags       = var.tags
}

并按照Istio官方文档完成以下安装步骤：

#Prerequisites
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

#create namespace
kubectl create namespace istio-system

# helm install istio-base and istiod
helm install istio-base istio/base -n istio-system
helm install istiod istio/istiod -n istio-system --wait

# Check the installation status
helm status istiod -n istio-system

#create namespace and enable istio-injection for envoy proxy containers
kubectl create namespace istio-ingress
kubectl label namespace istio-ingress istio-injection=enabled

## helm install istio-ingress for traffic management
helm install istio-ingress istio/gateway -n istio-ingress --wait

## Mark the default namespace as istio-injection=enabled
kubectl label namespace default istio-injection=enabled

## Install the App and Gateway
kubectl apply -f bookinfo.yaml
kubectl apply -f bookinfo-gateway.yaml

成功部署Bookinfo应用并可正常访问，该应用会在控制台输出日志。同时我已创建Log Analytics工作区：

# Create Log Analytics Workspace
module "log_analytics_workspace" {
  source                = "./modules/log_analytics_workspace"
  count                 = var.enable_log_analytics_workspace == true ? 1 : 0
  app_or_service_name   = "log" 
  subscription_type     = var.subscription_type 
  environment           = var.environment 
  resource_group_name   = azurerm_resource_group.rg.name 
  location              = var.location 
  instance_number       = var.instance_number  
  sku                   = var.log_analytics_workspace_sku
  retention_in_days     = var.log_analytics_workspace_retention_in_days 
  tags                  = var.tags
}

并在azurerm_kubernetes_cluster的oms_agent部分配置了log_analytics_workspace_id，用于将日志收集并发送至Log Analytics。但目前未看到应用日志流入，请问是否遗漏了必要配置？

你遗漏了几个关键配置，导致应用日志无法流入Log Analytics：

1. 启用AKS容器日志收集范围 #

默认情况下，AKS的OMS Agent仅收集集群组件（如kubelet、kube-proxy）的日志，不会自动收集应用容器的stdout/stderr日志。需要在Terraform的azurerm_kubernetes_cluster资源中扩展oms_agent配置，明确指定要收集的日志类型：

resource "azurerm_kubernetes_cluster" "k8s" {
  # 已有的其他配置...

  oms_agent {
    log_analytics_workspace_id = module.log_analytics_workspace[0].id
    # 启用日志收集并指定类别
    enabled = true
    metrics_enabled = true
    log_types = [
      "containerLogs", # 核心：收集所有容器的标准输出/错误日志
      "kubeSystemLogs",
      "kubeAuditLogs"
    ]
  }

  # 已有的其他配置...
}

containerLogs是收集应用日志的关键项，必须包含在配置中

2. 验证服务主体权限 #

确保AKS使用的服务主体拥有Log Analytics工作区的日志写入权限，可以通过Terraform添加角色赋值：

resource "azurerm_role_assignment" "aks_log_writer" {
  scope                = module.log_analytics_workspace[0].id
  role_definition_name = "Log Analytics Contributor"
  principal_id         = azurerm_service_principal.aks_sp.object_id # 替换为你的AKS服务主体ID
}

3. 检查OMS Agent运行状态 #

确认集群中OMS Agent Pod正常运行：

kubectl get pods -n kube-system | grep omsagent

若Pod状态异常，查看日志排查问题：

kubectl logs <omsagent-pod-name> -n kube-system

4. 验证Log Analytics数据查询 #

应用日志会流入Log Analytics的ContainerLog表，执行以下Kusto查询验证：

ContainerLog
| where ContainerName contains "bookinfo"
| limit 10

注意：日志同步存在10-15分钟的延迟，配置生效后需等待一段时间再查询

内容的提问来源于stack exchange，提问作者One Developer