CCE日志K8s事件查询

前提条件

• 已采集CCE日志，详情请参见云容器引擎CCE应用日志接入LTS。
• 日志配置结构化，详情请参见结构化配置。

背景信息

云容器引擎（Cloud Container Engine，简称CCE）提供高度可扩展的、高性能的企业级Kubernetes集群。借助云容器引擎，您可以在华为云上轻松部署、管理和扩展容器化应用程序。

分析网站访问情况

1. 登录云日志服务控制台。
2. 在左侧导航栏中选择“仪表盘 ”。
3. 在仪表盘模板下方，选择“CCE日志K8s事件查询”仪表盘，查看图表详情。

CCE日志K8s事件查询仪表盘中的过滤器说明如下所示：

• 事件等级分为Warning和Normal。
• 事件类型，所关联的查询分析语句如下所示：

  select distinct("name")

• 集群ID，所关联的查询分析语句如下所示：

  select distinct("cluster_id")

• 命名空间，所关联的查询分析语句如下所示：

  select distinct("namespace")

• 名称，所关联的查询分析语句如下所示：

  select distinct("resource_name")

重要图表说明

CCE日志K8s事件查询仪表盘中重要图表说明如下所示：

• 事件总数，所关联的查询分析语句如下所示：

  SELECT TIME_FORMAT( "_time_", 'yyyy-MM-dd HH:mm:ss', '' ) as "_time_","total" FROM ( SELECT TIME_CEIL ( __time, 'PT1H' ) AS "_time_", count( 1 ) AS "total" FROM log GROUP BY "_time_" )

• 普通事件数，所关联的查询分析语句如下所示：

  SELECT TIME_FORMAT( "_time_", 'yyyy-MM-dd HH:mm:ss', '' ) as "_time_","total" FROM ( SELECT TIME_CEIL ( __time, 'PT1H' ) AS "_time_", count( 1 ) AS "total" FROM log where "type" = 'Normal' GROUP BY "_time_" )

• 警告事件数，所关联的查询分析语句如下所示：

  SELECT TIME_FORMAT( "_time_", 'yyyy-MM-dd HH:mm:ss', '' ) as "_time_","total" FROM ( SELECT TIME_CEIL ( __time, 'PT1H' ) AS "_time_", count( 1 ) AS "total" FROM log where "type" = 'Warning' GROUP BY "_time_" )

• 错误事件数，所关联的查询分析语句如下所示：

  SELECT TIME_FORMAT( "_time_", 'yyyy-MM-dd HH:mm:ss', '' ) as "_time_","total" FROM ( SELECT TIME_CEIL ( __time, 'PT1H' ) AS "_time_", count( 1 ) AS "total" FROM log  where "type" = 'Error' GROUP BY "_time_" )

• 重要事件分布，所关联的查询分析语句如下所示：

  select "name",count(1) as 'total' from log group by "name"

• 重要事件统计，所关联的查询分析语句如下所示：

  SELECT "type" as "等级", "name" as "类型", count(1) as "总数", "reason" as "详细内容" from log where "type" != 'Normal'  group by "type", "name", "reason" order by "总数" desc

• Pod重要事件统计，所关联的查询分析语句如下所示：

  SELECT "type" as "等级", "name" as "类型",  count(1) as "总数", "reason" as "详细内容"  from log where "type" != 'Normal'  and "resource_kind" = 'Pod' group by  "type",  "name", "reason" order by "总数" desc

• 最近100条事件，所关联的查询分析语句如下所示：

  select TIME_FORMAT( __time, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as "Time","type" as "等级", "name" as "类型", "reason" as "详细