<p>I am using azure AKS for Mechine learning model deployment and it automatiaclly deploys models weekly</p>
<p>Now AKS produces more costs for log analytics data ingestion</p>
<p>We are working to optimize the data ingestion to the log analytics</p>
<p>i have two nodes in AKS</p>
<p>Somehow we can reduce some data ingestion. but when i see the data ingestion today for past 24 hour it again increases and when i try to see the nodes which produces billable data ingestion it shows one more filed which shows as 'deprecate field: see http://aka'</p>
<p>below i mentioned query and the query result for reference</p>
<p>query</p>
<pre><code>find where TimeGenerated &gt; ago(24h) project _BilledSize, Computer
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != &quot;&quot;
| summarize TotalVolumeBytes=sum(_BilledSize) by computerName
</code></pre>
<p>query result</p>
<pre><code>ComputerName                        TotalVolumeBytes

aks-agentpool-28198374-vmss000007   232,567,315 

aks-agentpool-28198374-vmss000001   617,340,843 

deprecated field: see http://aka    129,052 

computerName
deprecated field: see http://aka

TotalVolumeBytes
129052
</code></pre>
<p>Here aks-agentpool-28198374-vmss000007 and aks-agentpool-28198374-vmss000001 are my nodes</p>
<p>But i dont have any idea about  'deprecated field: see http://aka'</p>
<p>I am not handling ML model deployment(i dont know obviuosly) and i asked ML team and they also dont know how this came into this</p>
<p>I analyzed many documents and query but i could not get the answer about what it is and how to get rid of this.</p>
<p>Can anyone guide me on this what is this in my node list and how can i stop this?</p>

<p>The value you are getting <code>http://aka</code> is probably part of a link to some microsoft documentation. You are truncating it though when you do <code>tolower(tostring(split(Computer, '.')[0]))</code>.</p>
<p>Try add <code>Computer</code> to your summarize clause so that you can get the full link:</p>
<pre><code>find where TimeGenerated &gt; ago(24h) project _BilledSize, Computer
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != &quot;&quot;
| summarize TotalVolumeBytes=sum(_BilledSize) by computerName, Computer
</code></pre>
<p>Once you do this you discover that the value of the field <code>Computer</code> is <code>Deprecated field: see http://aka.ms/LA-Usage</code></p>
<p>Visiting <a href="https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/usage" rel="nofollow noreferrer">that link</a> tells you that the <code>Usage</code> table contains <em>&quot;Hourly usage data for each table in the workspace.&quot;</em> And in the column reference table you can see that there are a number of columns that are deprecated, for example &quot;Computer&quot;.</p>
<p>I.e The computer field is being deprecated and will later be removed from the usage table. It is still there, but the value of the field will always be <code>Deprecated field: see http://aka.ms/LA-Usage</code> , until it is removed indefinitely.</p>
<p>This just means that the <code>Computer</code> field in the Usage table should no longer be used and will be removed. The Usage table alone can no longer be used to determine which <code>Computer</code> incurred which cost.</p>
<p>You can query the usage table with the following query and see that the <code>Computer</code> field always conatains the deprecation message.</p>
<pre><code>Usage
| summarize sum(_BilledSize) by Computer, SourceSystem, DataType, Type
</code></pre>
<p><strong>EDIT:</strong></p>
<p>If you are concerned with finding which resource contributes more to the cost of your workspace rather than which resource generates the most logs (which do not necessarily need to be the same since some data is ingested for free in log analytics), please add <a href="https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#_isbillable" rel="nofollow noreferrer">_IsBillable</a> as a filter to your query to exclude entries that are not billed:</p>
<pre><code>find where TimeGenerated &gt; ago(24h) project _BilledSize, Computer, _IsBillable
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != &quot;&quot; and _IsBillable == true
| summarize TotalVolumeBytes=sum(_BilledSize) by computerName
</code></pre>
<p>Since the entries in the usage table where the field  <code>Computer</code> is a deprecated field is not billable it will not show up.</p>
