Count k8s container restarts

Problem / use case

You want to identify the Kubernetes container with the highest number of restarts across your logs. This helps prioritize investigation into unstable or crashing deployments.

Query

source logs
| choose resource.attributes.k8s_container_restart_count:number as restarts, 
         resource.attributes.k8s_container_name as container, 
         resource.attributes.k8s_deployment_name as deployment
| filter restarts > 0
| top 1 container, deployment by restarts

Expected output

A single log result showing:

{
    "container": "server",
    "deployment": "cartservice",
    "restarts": 236
}

TL;DR

Pinpoint the most restart-prone container with top 1 ... by restarts. Helps surface high-impact instability fast.

Conditionally count logs

Next Summarize container restarts