Rules (XQL)
[INGEST:vendor="msft", product="azure", target_dataset="msft_azure_aks_raw", no_hit = drop]
// Supported timestamp is for UTC time YYYY-mm-ddTHH:MM:SS.ssssZ format. E.g; 2025-02-04T11:23:29.0324070Z
filter
(
category in (
"cloud-controller-manager",
"cluster-autoscaler",
"kube-audit",
"kube-audit-admin",
"kube-apiserver",
"kube-controller-manager",
"kube-scheduler",
"csi-snapshot-controller",
"csi-azuredisk-controller",
"csi-azurefile-controller",
"SoftwareUpdateProfile",
"SoftwareUpdates",
"guard"
)
or Type in ("AKSAudit", "AKSAuditAdmin", "AKSControlPlane")
)
| alter
tmp_timestamp_extraction = if(
// Supported format for all of the below extractions in regex: \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z
requestreceivedtime != null, requestreceivedtime,
TimeGenerated != null, TimeGenerated,
to_string(properties -> log) -> requestReceivedTimestamp != null, to_string(properties -> log) -> requestReceivedTimestamp, time
)
| alter
_time = parse_timestamp("%Y-%m-%dT%H:%M:%E*SZ", tmp_timestamp_extraction)
| fields -tmp_*;