<p>There is a AKS running that is connected to Log Analytics in Azure.
I'm trying to view logs of named PODs using the following query snippet:</p>
<pre><code>let KubePodLogs = (clustername:string, podnameprefix:string) {
    let ContainerIdList = KubePodInventory
    | where ClusterName =~ clustername
    | where Name startswith strcat(podnameprefix, &quot;-&quot;)
    | where strlen(ContainerID)&gt;0
    | distinct ContainerID;
    ContainerLog
    | where ContainerID in (ContainerIdList)
    | join (KubePodInventory | project ContainerID, Name, PodLabel, Namespace, Computer) on ContainerID
    | project TimeGenerated, Node=Computer, Namespace, PodName=Name1, PodLabel, ContainerID, LogEntry
};
KubePodLogs('aks-my-cluster', 'my-service') | order by TimeGenerated desc
</code></pre>
<p>The above query does return rows of the matching PODs but not all that are actually available.</p>
<p>Trying to get results of the partial queries by inspecting POD details:</p>
<pre><code>KubePodInventory
    | where ClusterName =~ 'aks-my-cluster'
    | where Name startswith 'my-service-'
    | where strlen(ContainerID)&gt;0
    | distinct ContainerID;
</code></pre>
<p>gives me a container-id. Now feeding this container-id into another query shows more
results then the combined query from above. Why ?</p>
<pre><code>ContainerLog 
| where ContainerID == &quot;aec001...fc31&quot;
| order by TimeGenerated desc 
| project TimeGenerated, ContainerID, LogEntry
</code></pre>
<p>One thing I noticed is that the later simple query result contain log results that have a <code>LogEntry</code> field parsed from JSON formatted output of the POD. In the results I can expand <code>LogEntry</code>to more fields corresponding to the original JSON data of that POD log output.</p>
<p>I.e. it seems like the combined query ( with a join ) skips those JSON <code>LogEntry</code> <code>ContainerLog</code> entries, but why ?</p>
<p>As far as I can see the combined query doesn't filter in any way on the <code>LogEntry</code> field.</p>

<p>A changed query seems to produce the results I would expect:</p>
<p>I exchanged the <code>join</code> with a <code>lookup</code> and used more columns to distinct the <code>KubePodInventory</code> results.</p>
<pre><code>let KubePodLogs = (clustername:string, podnameprefix:string) {
    let ContainerIdList = KubePodInventory
    | where ClusterName =~ clustername
    | where Name startswith strcat(podnameprefix, &quot;-&quot;)
    | where strlen(ContainerID)&gt;0
    | distinct ContainerID, PodLabel, Namespace, PodIp, Name;
    ContainerLog
    | where ContainerID in (ContainerIdList)
    | lookup kind=leftouter (ContainerIdList) on ContainerID
    | project-away Image, ImageTag, Repository, Name, TimeOfCommand
    | project-rename PodName=Name1
};
KubePodLogs('aks-my-cluster', 'my-service') | order by TimeGenerated desc
</code></pre>
