Add log filtering support

README.md

@@ -66,6 +66,8 @@ The `aks-logs` tool will help you to query the Container logs running inside the
             AKS Cluster name. Required
       -containerName string
             Container name of the Kubernetes workload. Required
+      -contains string
+              Filter log entries by list of contents if specified. Example: -contains=val1,val2
       -endTime string
             End time of the log entries. Default to (current time) if not specified. Format: 2006-01-02T15:04:05.999999999+07:00
       -maxRecords int

build.sh

@@ -2,7 +2,7 @@
 
 GIT_REVISION=$(git rev-parse --short --verify HEAD)
 TIME=$(date -u +%Y%m%d.%H%M%S)
-VERSION=1.0.${GIT_REVISION}.${TIME}
+VERSION=1.1.${GIT_REVISION}.${TIME}
 
 build_artifacts () {
   local os=$1

cmd/aks-logs/main.go

@@ -6,6 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/mirage20/aks-logs/pkg/client"
@@ -18,6 +19,7 @@ var (
 	namespace         string
 	workloadName      string
 	containerName     string
+	contains          string
 	startTime         string
 	endTime           string
 
@@ -64,9 +66,15 @@ func main() {
 		ContainerName:     containerName,
 		StartTime:         start,
 		EndTime:           end,
-		MaxRecords:        maxRecords,
-		ShowQuery:         showQuery,
-		ShowDescending:    showDescending,
+		FilterContains: func() []string {
+			if len(strings.TrimSpace(contains)) > 0 {
+				return strings.Split(contains, ",")
+			}
+			return nil
+		}(),
+		MaxRecords:     maxRecords,
+		ShowQuery:      showQuery,
+		ShowDescending: showDescending,
 	}
 	ctx := context.Background()
 	resp, err := c.Query(ctx, &req)
@@ -119,6 +127,7 @@ func init() {
 	flag.StringVar(&containerName, "containerName", "", "Container name of the Kubernetes workload. Required")
 	flag.StringVar(&startTime, "startTime", "", "Start time of the log entries. Default to (current time - 24h) if not specified. Format: 2006-01-02T15:04:05.999999999+07:00")
 	flag.StringVar(&endTime, "endTime", "", "End time of the log entries. Default to (current time) if not specified. Format: 2006-01-02T15:04:05.999999999+07:00")
+	flag.StringVar(&contains, "contains", "", "Filter log entries by list of contents if specified. Example: -contains=val1,val2")
 	flag.IntVar(&maxRecords, "maxRecords", 0, "Maximum number of log entries to query. Default to 1000")
 	flag.BoolVar(&showDescending, "showDescending", false, "Output the logs in descending order based on generated time")
 	flag.BoolVar(&showQuery, "showQuery", false, "Output the Kusto query")

pkg/client/client.go

@@ -51,6 +51,9 @@ func (c *Client) Query(ctx context.Context, qReq *QueryRequest) (*QueryResponse,
 	sb.WriteString(fmt.Sprintf("| distinct ContainerID;\n"))
 	sb.WriteString(fmt.Sprintf("ContainerLog\n"))
 	sb.WriteString(fmt.Sprintf("| where ContainerID in (ContainerIdList)\n"))
+	for _, v := range qReq.FilterContains {
+		sb.WriteString(fmt.Sprintf("| where LogEntry contains '%s'\n", v))
+	}
 	sb.WriteString(fmt.Sprintf("| where TimeGenerated between (datetime(%s)..datetime(%s))\n", qReq.StartTime.In(locUtc).Format(datetimeFormat), qReq.EndTime.In(locUtc).Format(datetimeFormat)))
 
 	if qReq.ShowDescending {

pkg/client/types.go

@@ -14,6 +14,8 @@ type QueryRequest struct {
 	StartTime time.Time
 	EndTime   time.Time
 
+	FilterContains []string
+
 	MaxRecords     int
 	ShowQuery      bool
 	ShowDescending bool