我如何更好地优化这个Kusto查询以获得我的日志

Question

下面是我正在运行的查询，并为Azure K8s获取日志，但是生成日志需要花费很长时间，我希望有一种更好的方法来编写我已经写过的东西。一些Kusto专家可以在这里建议我如何更好的表现？

AzureDiagnostics 
| where Category == 'kube-audit'
| where TimeGenerated between (startofday(datetime("2022-03-26")) .. endofday(datetime("2022-03-27"))) 
| where (strlen(log_s) >= 32000
and not(log_s has "aksService") 
and not(log_s has "system:serviceaccount:crossplane-system:crossplane")    
or strlen(log_s) < 32000
| extend op = parse_json(log_s) 
| where not(tostring(op.verb) in ("list", "get", "watch"))   
| where substring(tostring(op.responseStatus.code), 0, 1) == "2"
| where not(tostring(op.requestURI) in ("/apis/authorization.k8s.io/v1/selfsubjectaccessreviews"))
| extend user = op.user.username
| extend decision = tostring(parse_json(tostring(op.annotations)).["authorization.k8s.io/decision"])
| extend requestURI = tostring(op.requestURI)
| extend name = tostring(parse_json(tostring(op.objectRef)).name)
| extend namespace = tostring(parse_json(tostring(op.objectRef)).namespace)
| extend verb = tostring(op.verb)
| project TimeGenerated, SubscriptionId, ResourceId, namespace, name, requestURI, verb, decision, ['user']
| order by TimeGenerated asc

Answer 1

您可以尝试按以下方式开始查询。

请注意最后的附加条件。

AzureDiagnostics 
| where TimeGenerated between (startofday(datetime("2022-03-26")) .. endofday(datetime("2022-03-27"))) 
| where Category == 'kube-audit'
| where log_s hasprefix '"code":2'

我假设code是整数，如果它是字符串，请使用以下(添加的限定符)

| where log_s has prefix '"code":"2'