Skip to content

KQL Queries¶

Use this section as a query catalog. Each page includes scenario context, data-source notes, query pipeline, interpretation guidance, and limitations.

flowchart LR
    subgraph Sources["Data Sources"]
        SYS["ContainerAppSystemLogs_CL"]
        CON["ContainerAppConsoleLogs_CL"]
    end
    subgraph Categories["Query Categories"]
        HTTP["HTTP"]
        RST["Restarts"]
        SYSREV["System and Revisions"]
        CONRT["Console and Runtime"]
        ING["Ingress and Networking"]
        SCL["Scaling and Replicas"]
        IDSEC["Identity and Secrets"]
        DAPR["Dapr and Jobs"]
        COR["Correlation"]
    end
    SYS --> RST
    SYS --> SYSREV
    SYS --> SCL
    SYS --> DAPR
    CON --> HTTP
    CON --> CONRT
    CON --> ING
    CON --> IDSEC
    SYS --> COR
    CON --> COR

Schema Note¶

Workspace table	Common columns
`ContainerAppConsoleLogs_CL`	`ContainerAppName_s`, `ContainerJobName_s`, `RevisionName_s`, `ContainerName_s`, `Log_s`, `Stream_s`, `ContainerImage_s`, `EnvironmentName_s`, `ContainerGroupName_s`
`ContainerAppSystemLogs_CL`	`ContainerAppName_s`, `RevisionName_s`, `Reason_s`, `Type_s`, `Log_s`, `Level`, `EventSource_s`, `ReplicaName_s`, `JobName_s`, `ExecutionName_s`, `EnvironmentName_s`
`ContainerAppConsoleLogs`	Newer schema in some workspaces
`ContainerAppSystemLogs`	Newer schema in some workspaces

If _CL tables are empty, check non-_CL tables in your workspace.

Sample Result¶

Real lifecycle summary from a deployed Container Apps environment:

Reason_s	Type_s	count_
ProbeFailed	Warning	74
RevisionUpdate	Normal	14
ContainerAppUpdate	Normal	9
RevisionReady	Normal	7
ContainerAppReady	Normal	6
KEDAScalersStarted	Normal	6
RevisionDeactivating	Normal	5
ContainerStarted	Normal	3
PulledImage	Normal	3
ContainerCreated	Normal	3
AssigningReplica	Normal	3
PullingImage	Normal	2
ContainerTerminated	Warning	2

Query Categories¶

HTTP¶

Restarts¶

System and Revisions¶

Console and Runtime¶

Ingress and Networking¶

Scaling and Replicas¶

Identity and Secrets¶

Dapr and Jobs¶

Correlation¶

See Also¶

Sources¶