Document status	35 - Reviewed

Container Apps Historical Logs with KQL and Log Analytics Workspace

This guide explains how to query historical logs for Azure Container Apps using Kusto Query Language (KQL) in Log Analytics Workspace.

Overview

While Log Stream in the Azure Portal shows real-time logs, it's not suitable for debugging past issues. For historical log analysis, use Log Analytics Workspace with KQL queries.

Accessing Log Analytics

1. Navigate to your Container App in Azure Portal
2. Select Logs under the Monitoring section
3. This opens the Log Analytics query editor connected to your workspace

You can also access Log Analytics directly via the Azure Portal by searching for the Log Analytics Workspace, e.g. ec---log

Common KQL Queries

Using this query will show you all the logs for a specific Container App revision and replica, where DAPR logs are excluded:

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name""
| where RevisionName_s == "your-revision-name"
| where ContainerGroupName_s == "your-container-replica-name"
| where ContainerName_s !contains "dapr"
| order by TimeGenerated desc
| project TimeGenerated, Log_s
| take 2000

The following sections provide more example queries on how to find e.g. the revision name or replica name, if you dont know the values yet (they can also be found in the Azure Portal)

Basic Query - All Logs for a Container App

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name"
| order by TimeGenerated desc
| take 100

Filter out DAPR Logs

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name"
| where ContainerName_s !contains "dapr"
| order by TimeGenerated desc
| take 100

Find Current Active Revision

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name"
| summarize LastLog = max(TimeGenerated) by RevisionName_s
| order by LastLog desc
| take 1

Copy paste the RevisionName_s from the result to use in further queries.

Filter by Revision (Docker Image / Version)

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name"
| where RevisionName_s == "your-revision-name"
| where ContainerName_s !contains "dapr"
| order by TimeGenerated desc
| take 100

Find Replicas (How many instances are running)

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name""
| where RevisionName_s == "your-revision-name"
| summarize LastLog = max(TimeGenerated) by ContainerGroupName_s
| order by LastLog desc

Filter by Replica also

ContainerAppConsoleLogs_CL
| where ContainerAppName_s == "your-container-app-name""
| where RevisionName_s == "your-revision-name"
| where ContainerGroupName_s == "your-container-replica-name"
| where ContainerName_s !contains "dapr"
| order by TimeGenerated desc
| take 100

Key Columns Reference

Column	Description
TimeGenerated	Timestamp of the log entry
Log_s	The actual log message
ContainerAppName_s	Name of the Container App
RevisionName_s	Name of the revision
ReplicaName_s	Name of the replica instance
ContainerName_s	Container name (filter out dapr for app logs only)

KQL Operators Reference

Operator	Description	Example
==	Exact match	where ContainerAppName_s == "my-app"
!=	Not equal	where ContainerName_s != "daprd"
contains	Case-insensitive substring	where Log_s contains "error"
!contains	Does not contain	where ContainerName_s !contains "dapr"
has	Word boundary match (faster)	where Log_s has "error"
!has	Does not have word	where ContainerName_s !has "dapr"

Tips

• Exclude Dapr logs: Always add | where ContainerName_s !contains "dapr" to filter out Dapr sidecar logs
• Use project: Limit columns returned for cleaner output
• Performance: Use has instead of contains when searching for whole words (it's faster)
• Time filtering: Add time filters early in your query to improve performance
• Save queries: Save frequently used queries in Log Analytics for quick access