如何在Azure Log Insights的KQL磁盘日志查询中排除D盘等临时存储

要在你的Azure Log Insights磁盘日志查询中排除D:盘或其他临时存储设备，可通过以下两种方式实现：

1. 直接排除指定盘符 #

如果明确知道要排除的盘符（比如D:），在解析出mountId后添加where子句过滤即可：

InsightsMetrics
  | where Name == "FreeSpaceMB"
  | extend Tags = parse_json(Tags)
  | extend mountId = tostring(Tags["vm.azm.ms/mountId"])
          ,diskSizeMB = toreal(Tags["vm.azm.ms/diskSizeMB"])
  // 排除D:盘
  | where mountId != "D:"
  | project-rename FreeSpaceMB = Val
  | summarize arg_max(TimeGenerated, diskSizeMB, FreeSpaceMB) by Computer, mountId
           ,FreeSpacePercentage = round(FreeSpaceMB / diskSizeMB * 100, 1)
  | extend diskSizeGB = round(diskSizeMB / 1024, 1)
          ,FreeSpaceGB = round(FreeSpaceMB / 1024, 1)
  | project TimeGenerated, Computer, mountId, diskSizeGB, FreeSpaceGB, FreeSpacePercentage
  | order by Computer asc, mountId asc

2. 排除临时存储设备（更通用） #

Azure VM的临时磁盘会在Tags中标记为Temporary类型，结合盘符和磁盘类型过滤，能覆盖更多场景：

InsightsMetrics
  | where Name == "FreeSpaceMB"
  | extend Tags = parse_json(Tags)
  | extend mountId = tostring(Tags["vm.azm.ms/mountId"])
          ,diskSizeMB = toreal(Tags["vm.azm.ms/diskSizeMB"])
          ,diskType = tostring(Tags["vm.azm.ms/diskType"])
  // 排除D:盘和所有临时存储设备
  | where mountId != "D:" and diskType != "Temporary"
  | project-rename FreeSpaceMB = Val
  | summarize arg_max(TimeGenerated, diskSizeMB, FreeSpaceMB) by Computer, mountId
           ,FreeSpacePercentage = round(FreeSpaceMB / diskSizeMB * 100, 1)
  | extend diskSizeGB = round(diskSizeMB / 1024, 1)
          ,FreeSpaceGB = round(FreeSpaceMB / 1024, 1)
  | project TimeGenerated, Computer, mountId, diskSizeGB, FreeSpaceGB, FreeSpacePercentage
  | order by Computer asc, mountId asc

补充说明 #

• 若需排除多个盘符，可使用where mountId !in ("D:", "E:")语法
• 临时存储设备的diskType字段值固定为Temporary，通过该字段可精准过滤Azure提供的临时磁盘，无需依赖盘符判断

内容的提问来源于stack exchange，提问作者Dexter