如何更好地优化这个Kusto查询来获取日志

Question

我在下面查询我正在运行的Azure K8s并获取日志，但生成日志需要几个小时，我希望有更好的方法来编写我已经编写的内容。Kusto的一些专家能在这里建议我如何才能提高表现吗？

AzureDiagnostics 
| where Category == 'kube-audit'
| where TimeGenerated between (startofday(datetime("2022-03-26")) .. endofday(datetime("2022-03-27"))) 
| where (strlen(log_s) >= 32000
and not(log_s has "aksService") 
and not(log_s has "system:serviceaccount:crossplane-system:crossplane")    
or strlen(log_s) < 32000
| extend op = parse_json(log_s) 
| where not(tostring(op.verb) in ("list", "get", "watch"))   
| where substring(tostring(op.responseStatus.code), 0, 1) == "2"
| where not(tostring(op.requestURI) in ("/apis/authorization.k8s.io/v1/selfsubjectaccessreviews"))
| extend user = op.user.username
| extend decision = tostring(parse_json(tostring(op.annotations)).["authorization.k8s.io/decision"])
| extend requestURI = tostring(op.requestURI)
| extend name = tostring(parse_json(tostring(op.objectRef)).name)
| extend namespace = tostring(parse_json(tostring(op.objectRef)).namespace)
| extend verb = tostring(op.verb)
| project TimeGenerated, SubscriptionId, ResourceId, namespace, name, requestURI, verb, decision, ['user']
| order by TimeGenerated asc

Answer 1

您可以尝试按如下方式启动查询
请注意末尾的附加条件。

AzureDiagnostics 
| where TimeGenerated between (startofday(datetime("2022-03-26")) .. endofday(datetime("2022-03-27"))) 
| where Category == 'kube-audit'
| where log_s hasprefix '"code":2'

我假设code是整数，如果它是字符串，请使用以下(添加的限定符(

| where log_s has prefix '"code":"2'