Mv-expand functions in KQL is [Expands multi-value dynamic arrays or property bags into multiple records.]
Could this functionality be implemented in logql? As a result of reading the documentation, it seems that it is not supported by its own function. If you have any clues or links that might help, I’ll check it out.
In the following example, I have a bunch of logs in an array and I want to detach them one by one.
{
"records": [
{
"category": "kube-audit-admin",
"operationName": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
"properties": {
"containerID": "10ecf0eb217bbbf0ff6913d7cfff9cb5b1167b32bcbcbc971fcde7ed4d338c3e",
"log": "{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"RequestResponse\",\"auditID\":\"81cd4522-b849-4271-8a78-04da3c569cdc\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/nodes/aks-user-16646159-vmss000000?fieldManager=kubectl-label\",\"verb\":\"patch\",\"user\":{\"username\":\"aksService\",\"groups\":[\"system:masters\",\"system:authenticated\"]},\"sourceIPs\":[\"127.0.0.1\"],\"userAgent\":\"kubectl/v1.25.6 (linux/amd64) kubernetes/dc2f9dc\",\"objectRef\":{\"resource\":\"nodes\",\"name\":\"aks-user-16646159-vmss000000\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestObject\":{},\"responseObject\":{\"kind\":\"Node\",\"apiVersion\":\"v1\",\"metadata\":{\"name\":\"aks-user-16646159-vmss000000\",\"uid\":\"27ee700a-70f8-4500-810c-a9e84d30d700\",\"resourceVersion\":\"131951\",\"creationTimestamp\":\"2023-05-22T23:18:58Z\",\"labels\":{\"agentpool\":\"user\",\"beta.kubernetes.io/arch\":\"amd64\",\"beta.kubernetes.io/instance-type\":\"Standard_D2as_v4\",\"beta.kubernetes.io/os\":\"linux\",\"failure-domain.beta.kubernetes.io/region\":\"koreacentral\",\"failure-domain.beta.kubernetes.io/zone\":\"koreacentral-1\",\"kubernetes.azure.com/agentpool\":\"user\",\"kubernetes.azure.com/cluster\":\"0523-aks-nodeResourceGroup\",\"kubernetes.azure.com/kubelet-identity-client-id\":\"20fb07ba-151d-498f-99b5-f552e7bfacaa\",\"kubernetes.azure.com/mode\":\"user\",\"kubernetes.azure.com/node-image-version\":\"AKSUbuntu-2204gen2containerd-202305.08.0\",\"kubernetes.azure.com/os-sku\":\"Ubuntu\",\"kubernetes.azure.com/role\":\"agent\",\"kubernetes.azure.com/storageprofile\":\"managed\",\"kubernetes.azure.com/storagetier\":\"Premium_LRS\",\"kubernetes.io/arch\":\"amd64\",\"kubernetes.io/hostname\":\"aks-user-16646159-vmss000000\",\"kubernetes.io/os\":\"linux\",\"kubernetes.io/role\":\"agent\",\"node-role.kubernetes.io/agent\":\"\",\"node.kubernetes.io/instance-type\":\"Standard_D2as_v4\",\"storageprofile\":\"managed\",\"storagetier\":\"Premium_LRS\",\"topology.disk.csi.azure.com/zone\":\"koreacentral-1\",\"topology.kubernetes.io/region\":\"koreacentral\",\"topology.kubernetes.io/zone\":\"koreacentral-1\"},\"annotations\":{\"csi.volume.kubernetes.io/nodeid\":\"{\\\"blob.csi.azure.com\\\":\\\"aks-user-16646159-vmss000000\\\",\\\"disk.csi.azure.com\\\":\\\"aks-user-16646159-vmss000000\\\",\\\"file.csi.azure.com\\\":\\\"aks-user-16646159-vmss000000\\\"}\",\"node.alpha.kubernetes.io/ttl\":\"0\",\"volumes.kubernetes.io/controller-managed-attach-detach\":\"true\"},\"managedFields\":[{\"manager\":\"kube-controller-manager\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2023-05-22T23:18:58Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\"f:node.alpha.kubernetes.io/ttl\":{}}}}},{\"manager\":\"kubelet\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2023-05-22T23:18:58Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\".\":{},\"f:volumes.kubernetes.io/controller-managed-attach-detach\":{}},\"f:labels\":{\".\":{},\"f:agentpool\":{},\"f:beta.kubernetes.io/arch\":{},\"f:beta.kubernetes.io/os\":{},\"f:kubernetes.azure.com/agentpool\":{},\"f:kubernetes.azure.com/cluster\":{},\"f:kubernetes.azure.com/kubelet-identity-client-id\":{},\"f:kubernetes.azure.com/mode\":{},\"f:kubernetes.azure.com/node-image-version\":{},\"f:kubernetes.azure.com/os-sku\":{},\"f:kubernetes.azure.com/role\":{},\"f:kubernetes.azure.com/storageprofile\":{},\"f:kubernetes.azure.com/storagetier\":{},\"f:kubernetes.io/arch\":{},\"f:kubernetes.io/hostname\":{},\"f:kubernetes.io/os\":{}}}}},{\"manager\":\"cloud-node-manager\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2023-05-22T23:19:05Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:labels\":{\"f:beta.kubernetes.io/instance-type\":{},\"f:failure-domain.beta.kubernetes.io/region\":{},\"f:failure-domain.beta.kubernetes.io/zone\":{},\"f:node.kubernetes.io/instance-type\":{},\"f:topology.kubernetes.io/region\":{},\"f:topology.kubernetes.io/zone\":{}}},\"f:spec\":{\"f:providerID\":{}}}},{\"manager\":\"kubectl-label\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2023-05-22T23:19:37Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:labels\":{\"f:kubernetes.io/role\":{},\"f:node-role.kubernetes.io/agent\":{}}}}},{\"manager\":\"node-problem-detector\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2023-05-23T07:53:18Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:status\":{\"f:conditions\":{\"k:{\\\"type\\\":\\\"ContainerRuntimeProblem\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"FilesystemCorruptionProblem\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"FrequentContainerdRestart\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"FrequentDockerRestart\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"FrequentKubeletRestart\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"FrequentUnregisterNetDevice\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"KernelDeadlock\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"KubeletProblem\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"ReadonlyFilesystem\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}},\"k:{\\\"type\\\":\\\"VMEventScheduled\\\"}\":{\".\":{},\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{},\"f:type\":{}}}}},\"subresource\":\"status\"},{\"manager\":\"kubelet\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2023-05-23T07:54:19Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\"f:csi.volume.kubernetes.io/nodeid\":{}},\"f:labels\":{\"f:topology.disk.csi.azure.com/zone\":{}}},\"f:status\":{\"f:conditions\":{\"k:{\\\"type\\\":\\\"DiskPressure\\\"}\":{\"f:lastHeartbeatTime\":{}},\"k:{\\\"type\\\":\\\"MemoryPressure\\\"}\":{\"f:lastHeartbeatTime\":{}},\"k:{\\\"type\\\":\\\"PIDPressure\\\"}\":{\"f:lastHeartbeatTime\":{}},\"k:{\\\"type\\\":\\\"Ready\\\"}\":{\"f:lastHeartbeatTime\":{},\"f:lastTransitionTime\":{},\"f:message\":{},\"f:reason\":{},\"f:status\":{}}},\"f:images\":{}}},\"subresource\":\"status\"}]},\"spec\":{\"providerID\":\"azure:///subscriptions/a924c3a4-3b2a-45cd-bbf2-cc469167f645/resourceGroups/0523-aks-noderesourcegroup/providers/Microsoft.Compute/virtualMachineScaleSets/aks-user-16646159-vmss/virtualMachines/0\"},\"status\":{\"capacity\":{\"cpu\":\"2\",\"ephemeral-storage\":\"129886128Ki\",\"hugepages-1Gi\":\"0\",\"hugepages-2Mi\":\"0\",\"memory\":\"8142104Ki\",\"pods\":\"30\"},\"allocatable\":{\"cpu\":\"1900m\",\"ephemeral-storage\":\"119703055367\",\"hugepages-1Gi\":\"0\",\"hugepages-2Mi\":\"0\",\"memory\":\"5486872Ki\",\"pods\":\"30\"},\"conditions\":[{\"type\":\"FrequentKubeletRestart\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"NoFrequentKubeletRestart\",\"message\":\"kubelet is functioning properly\"},{\"type\":\"FrequentDockerRestart\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"NoFrequentDockerRestart\",\"message\":\"docker is functioning properly\"},{\"type\":\"ContainerRuntimeProblem\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"ContainerRuntimeIsUp\",\"message\":\"container runtime service is up\"},{\"type\":\"FrequentUnregisterNetDevice\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"NoFrequentUnregisterNetDevice\",\"message\":\"node is functioning properly\"},{\"type\":\"VMEventScheduled\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"NoVMEventScheduled\",\"message\":\"VM has no scheduled event\"},{\"type\":\"KubeletProblem\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"KubeletIsUp\",\"message\":\"kubelet service is up\"},{\"type\":\"FrequentContainerdRestart\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"NoFrequentContainerdRestart\",\"message\":\"containerd is functioning properly\"},{\"type\":\"KernelDeadlock\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"KernelHasNoDeadlock\",\"message\":\"kernel has no deadlock\"},{\"type\":\"ReadonlyFilesystem\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"FilesystemIsNotReadOnly\",\"message\":\"Filesystem is not read-only\"},{\"type\":\"FilesystemCorruptionProblem\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:53:18Z\",\"lastTransitionTime\":\"2023-05-22T23:27:16Z\",\"reason\":\"FilesystemIsOK\",\"message\":\"Filesystem is healthy\"},{\"type\":\"MemoryPressure\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:54:19Z\",\"lastTransitionTime\":\"2023-05-22T23:18:58Z\",\"reason\":\"KubeletHasSufficientMemory\",\"message\":\"kubelet has sufficient memory available\"},{\"type\":\"DiskPressure\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:54:19Z\",\"lastTransitionTime\":\"2023-05-22T23:18:58Z\",\"reason\":\"KubeletHasNoDiskPressure\",\"message\":\"kubelet has no disk pressure\"},{\"type\":\"PIDPressure\",\"status\":\"False\",\"lastHeartbeatTime\":\"2023-05-23T07:54:19Z\",\"lastTransitionTime\":\"2023-05-22T23:18:58Z\",\"reason\":\"KubeletHasSufficientPID\",\"message\":\"kubelet has sufficient PID available\"},{\"type\":\"Ready\",\"status\":\"True\",\"lastHeartbeatTime\":\"2023-05-23T07:54:19Z\",\"lastTransitionTime\":\"2023-05-22T23:19:09Z\",\"reason\":\"KubeletReady\",\"message\":\"kubelet is posting ready status. AppArmor enabled\"}],\"addresses\":[{\"type\":\"InternalIP\",\"address\":\"10.0.1.5\"},{\"type\":\"Hostname\",\"address\":\"aks-user-16646159-vmss000000\"}],\"daemonEndpoints\":{\"kubeletEndpoint\":{\"Port\":10250}},\"nodeInfo\":{\"machineID\":\"98f2493d675b46ce925e148e9dc96145\",\"systemUUID\":\"679b4c5a-14af-4a64-be1a-f0a6957b650c\",\"bootID\":\"32cdedfa-d6f5-40dc-9467-6638eefa748e\",\"kernelVersion\":\"5.15.0-1037-azure\",\"osImage\":\"Ubuntu 22.04.2 LTS\",\"containerRuntimeVersion\":\"containerd://1.6.18+azure-1\",\"kubeletVersion\":\"v1.25.6\",\"kubeProxyVersion\":\"v1.25.6\",\"operatingSystem\":\"linux\",\"architecture\":\"amd64\"},\"images\":[{\"names\":[\"mcr.microsoft.com/oss/calico/cni:v3.23.3\"],\"sizeBytes\":254912666},{\"names\":[\"mcr.microsoft.com/azuremonitor/containerinsights/ciprod/prometheus-collector/images:6.7.0-main-05-04-2023-4450ad10\"],\"sizeBytes\":248526798},{\"names\":[\"mcr.microsoft.com/azuremonitor/containerinsights/ciprod/prometheus-collector/images:6.6.0-main-04-25-2023-2eb2a81c\"],\"sizeBytes\":248485440},{\"names\":[\"mcr.microsoft.com/oss/calico/node:v3.24.0\"],\"sizeBytes\":242155228},{\"names\":[\"mcr.microsoft.com/oss/calico/node:v3.23.3\"],\"sizeBytes\":210001116},{\"names\":[\"mcr.microsoft.com/aks/acc/sgx-attestation:3.3\"],\"sizeBytes\":209793835},{\"names\":[\"mcr.microsoft.com/oss/calico/cni:v3.24.0\"],\"sizeBytes\":197455452},{\"names\":[\"mcr.microsoft.com/oss/tigera/operator:v1.23.8\"],\"sizeBytes\":184105789},{\"names\":[\"mcr.microsoft.com/oss/cilium/cilium:1.12.5.2\"],\"sizeBytes\":170777421},{\"names\":[\"mcr.microsoft.com/oss/cilium/cilium:1.12.8\"],\"sizeBytes\":167918208},{\"names\":[\"mcr.microsoft.com/azuremonitor/containerinsights/ciprod:3.1.7\"],\"sizeBytes\":154968706},{\"names\":[\"mcr.microsoft.com/oss/calico/kube-controllers:v3.23.3\"],\"sizeBytes\":127665612},{\"names\":[\"mcr.microsoft.com/containernetworking/azure-cns:v1.4.44\"],\"sizeBytes\":125256713},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.2.2.5\"],\"sizeBytes\":123925992},{\"names\":[\"mcr.microsoft.com/oss/calico/typha:v3.23.3\"],\"sizeBytes\":123064920},{\"names\":[\"mcr.microsoft.com/containernetworking/azure-cns:v1.4.39\"],\"sizeBytes\":108128135},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/blob-csi@sha256:9bc43937f68018b447cb87ff2020e8ea7b1b9db3b444a1224f3fcef6c3f8bdaf\",\"mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.19.5\"],\"sizeBytes\":108020905},{\"names\":[\"mcr.microsoft.com/oss/kubernetes/ingress/nginx-ingress-controller:v1.2.1\"],\"sizeBytes\":107169290},{\"names\":[\"mcr.microsoft.com/oss/calico/node:v3.8.9.5\"],\"sizeBytes\":101794833},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.26.2.2\"],\"sizeBytes\":99405021},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.26.3\"],\"sizeBytes\":99113379},{\"names\":[\"mcr.microsoft.com/containernetworking/azure-npm:v1.4.45\"],\"sizeBytes\":90870486},{\"names\":[\"mcr.microsoft.com/containernetworking/azure-npm:v1.4.32\"],\"sizeBytes\":90048618},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azurefile-csi:v1.2.2\"],\"sizeBytes\":88551490},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azurefile-csi:v1.24.0\"],\"sizeBytes\":81899739},{\"names\":[\"mcr.microsoft.com/oss/nvidia/k8s-device-plugin:v0.13.0.7\"],\"sizeBytes\":80468007},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azurefile-csi:v1.24.1\"],\"sizeBytes\":73733345},{\"names\":[\"docker.io/grafana/promtail@sha256:db66221bcc9510f3101121d42354b19c83cb810c5480e4936eb75c43443656f4\",\"docker.io/grafana/promtail:2.7.4\"],\"sizeBytes\":72730023},{\"names\":[\"mcr.microsoft.com/oss/calico/kube-controllers:v3.24.0\"],\"sizeBytes\":71347091},{\"names\":[\"mcr.microsoft.com/containernetworking/cni-dropgz:v0.0.4\"],\"sizeBytes\":68392344},{\"names\":[\"mcr.microsoft.com/oss/tigera/operator:v1.28.0\"],\"sizeBytes\":67441354},{\"names\":[\"mcr.microsoft.com/containernetworking/cni-dropgz:v0.0.2\"],\"sizeBytes\":67202663},{\"names\":[\"mcr.microsoft.com/oss/calico/typha:v3.24.0\"],\"sizeBytes\":65983776},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/secrets-store/driver:v1.3.0.3\"],\"sizeBytes\":65378171},{\"names\":[\"mcr.microsoft.com/oss/tigera/operator:v1.27.12\"],\"sizeBytes\":64784076},{\"names\":[\"mcr.microsoft.com/oss/kubernetes/kube-proxy:v1.25.6-hotfix.20230407.1\"],\"sizeBytes\":64770054},{\"names\":[\"mcr.microsoft.com/oss/calico/cni:v3.8.9.3\"],\"sizeBytes\":63581323},{\"names\":[\"mcr.microsoft.com/oss/kubernetes/kube-proxy@sha256:b48f7189b854fd32898f3b8d7c228aaf9e761f4d6656dd5df1fe2eaaf8d39905\",\"mcr.microsoft.com/oss/kubernetes/kube-proxy:v1.25.6\"],\"sizeBytes\":63292155},{\"names\":[\"docker.io/library/nginx@sha256:a2f6ffddd272625464710d6189f1bf5d02e068392facae344762a512209e74d5\",\"docker.io/library/nginx:latest\"],\"sizeBytes\":57002968},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azuredisk-csi:v1.27.1\"],\"sizeBytes\":56902058},{\"names\":[\"mcr.microsoft.com/oss/azure/aad-pod-identity/nmi:v1.8.13.4\"],\"sizeBytes\":56803813},{\"names\":[\"mcr.microsoft.com/oss/nginx/nginx:1.21.6\"],\"sizeBytes\":56703094},{\"names\":[\"mcr.microsoft.com/oss/azure/aad-pod-identity/nmi:v1.8.13.3\"],\"sizeBytes\":55776257},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/secrets-store/driver:v1.3.3\"],\"sizeBytes\":54053664},{\"names\":[\"mcr.microsoft.com/oss/kubernetes-csi/azurefile-csi:v1.26.2\"],\"sizeBytes\":46926532},{\"names\":[\"mcr.microsoft.com/aks/acc/sgx-device-plugin:1.0\"],\"sizeBytes\":42023095},{\"names\":[\"mcr.microsoft.com/oss/kubernetes/kube-state-metrics:v2.6.0\"],\"sizeBytes\":39699428},{\"names\":[\"mcr.microsoft.com/aks/acc/sgx-webhook:1.1\"],\"sizeBytes\":38998197},{\"names\":[\"mcr.microsoft.com/oss/open-policy-agent/gatekeeper:v3.11.0\"],\"sizeBytes\":35244552},{\"names\":[\"quay.io/prometheus/alertmanager@sha256:fd4d9a3dd1fd0125108417be21be917f19cc76262347086509a0d43f29b80e98\",\"quay.io/prometheus/alertmanager:v0.25.0\"],\"sizeBytes\":30790064}]}},\"requestReceivedTimestamp\":\"2023-05-23T07:55:57.758646Z\",\"stageTimestamp\":\"2023-05-23T07:55:57.776455Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"\"}}\n",
"stream": "stdout",
"collectedBy": "fluent-bit",
"pod": "kube-apiserver-5966d96c9d-fmgx2"
},
"resourceId": "/SUBSCRIPTIONS/A924C3A4-3B2A-45CD-BBF2-CC469167F645/RESOURCEGROUPS/0523-RG/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/0523-AKS",
"time": "2023-05-23T07:55:57.777294644Z"
},
{
"category": "kube-audit-admin",
"operationName": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
"properties": {
"containerID": "10ecf0eb217bbbf0ff6913d7cfff9cb5b1167b32bcbcbc971fcde7ed4d338c3e",
"log": "{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"71190e79-024a-4a47-8b91-221d653a14a0\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/external-resizer-disk-csi-azure-com\",\"verb\":\"update\",\"user\":{\"username\":\"aksService\",\"groups\":[\"system:masters\",\"system:authenticated\"]},\"sourceIPs\":[\"172.31.6.110\"],\"userAgent\":\"Go-http-client/2.0\",\"objectRef\":{\"resource\":\"leases\",\"namespace\":\"kube-system\",\"name\":\"external-resizer-disk-csi-azure-com\",\"uid\":\"1ae7fc43-1b19-434f-9b66-5779177cf1b0\",\"apiGroup\":\"coordination.k8s.io\",\"apiVersion\":\"v1\",\"resourceVersion\":\"132334\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2023-05-23T07:55:57.828763Z\",\"stageTimestamp\":\"2023-05-23T07:55:57.834204Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"\"}}\n",
"stream": "stdout",
"collectedBy": "fluent-bit",
"pod": "kube-apiserver-5966d96c9d-fmgx2"
},
"resourceId": "/SUBSCRIPTIONS/A924C3A4-3B2A-45CD-BBF2-CC469167F645/RESOURCEGROUPS/0523-RG/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/0523-AKS",
"time": "2023-05-23T07:55:57.834405257Z"
},
{
"category": "kube-audit-admin",
"operationName": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
"properties": {
"containerID": "10ecf0eb217bbbf0ff6913d7cfff9cb5b1167b32bcbcbc971fcde7ed4d338c3e",
"log": "{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"c5a89597-004f-4dfa-9f60-b13da6a4432a\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kube-controller-manager?timeout=5s\",\"verb\":\"update\",\"user\":{\"username\":\"aksService\",\"groups\":[\"system:masters\",\"system:authenticated\"]},\"sourceIPs\":[\"172.31.92.115\"],\"userAgent\":\"kube-controller-manager/v1.25.6 (linux/amd64) kubernetes/dc2f9dc/leader-election\",\"objectRef\":{\"resource\":\"leases\",\"namespace\":\"kube-system\",\"name\":\"kube-controller-manager\",\"uid\":\"a2ba48bf-c859-483b-bb48-fa6d70618b44\",\"apiGroup\":\"coordination.k8s.io\",\"apiVersion\":\"v1\",\"resourceVersion\":\"132351\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2023-05-23T07:55:58.611046Z\",\"stageTimestamp\":\"2023-05-23T07:55:58.617490Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"\"}}\n",
"stream": "stdout",
"collectedBy": "fluent-bit",
"pod": "kube-apiserver-5966d96c9d-fmgx2"
},
"resourceId": "/SUBSCRIPTIONS/A924C3A4-3B2A-45CD-BBF2-CC469167F645/RESOURCEGROUPS/0523-RG/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/0523-AKS",
"time": "2023-05-23T07:55:58.61769809Z"
},
{
"category": "kube-audit-admin",
"operationName": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
"properties": {
"containerID": "10ecf0eb217bbbf0ff6913d7cfff9cb5b1167b32bcbcbc971fcde7ed4d338c3e",
"log": "{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"5c74fc48-d033-4663-9aa5-5cf959b54ce8\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/external-snapshotter-leader-disk-csi-azure-com\",\"verb\":\"update\",\"user\":{\"username\":\"aksService\",\"groups\":[\"system:masters\",\"system:authenticated\"]},\"sourceIPs\":[\"172.31.6.110\"],\"userAgent\":\"Go-http-client/2.0\",\"objectRef\":{\"resource\":\"leases\",\"namespace\":\"kube-system\",\"name\":\"external-snapshotter-leader-disk-csi-azure-com\",\"uid\":\"308aa330-1a76-49df-bd11-82aed3964ead\",\"apiGroup\":\"coordination.k8s.io\",\"apiVersion\":\"v1\",\"resourceVersion\":\"132338\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2023-05-23T07:55:59.398246Z\",\"stageTimestamp\":\"2023-05-23T07:55:59.403176Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"\"}}\n",
"stream": "stdout",
"collectedBy": "fluent-bit",
"pod": "kube-apiserver-5966d96c9d-fmgx2"
},
"resourceId": "/SUBSCRIPTIONS/A924C3A4-3B2A-45CD-BBF2-CC469167F645/RESOURCEGROUPS/0523-RG/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/0523-AKS",
"time": "2023-05-23T07:55:59.403425911Z"
}
]