improve examples

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

Author: mblaschke

README.md

@@ -54,8 +54,12 @@ Global metrics
 | `azure_loganalytics_query_requests`  | Count of requests (eg paged subqueries) per query                              |
 
 
-Example
--------
+Examples
+--------
+
+see [example.yaml](example.yaml) for general ingestion metrics (number of rows per second and number of bytes per second per table)
+
+see [example.aks.yaml](example.aks.yaml) for AKS namespace ingestion metrics (number of rows per second and number of bytes per AKS namespace)
 
 more examples of result processing can be found within [azure-resourcegraph-expoter](https://github.com/webdevops/azure-resourcegraph-exporter) (uses same processing library)
 

example.aks.yaml

@@ -0,0 +1,48 @@
+queries:
+  #########################################################
+  ## rows metric for tables (per second)
+  - metric: azure_metrics_loganalytics_ingestion_aks_rows
+    query: |-
+      ContainerLog
+      | join kind = inner (KubePodInventory
+          | project ContainerID, PodName=Name, ControllerKind, ControllerName, Namespace
+          | distinct *
+      ) on ContainerID
+      | project Namespace
+      | summarize count_ = count() by Namespace
+      | project Namespace, count_ = (todouble(count_) / 3600)
+    timespan: PT1H
+    fields:
+      -
+        name: Namespace
+        target: sourceNamespace
+        type: id
+      -
+        name: count_
+        type: value
+    defaultField:
+      type: ignore
+
+  #########################################################
+  ## bytes metric for tables (per second)
+  - metric: azure_metrics_loganalytics_ingestion_aks_bytes
+    query: |-
+      ContainerLog
+      | where _IsBillable == true
+      | join kind = inner (KubePodInventory
+          | project ContainerID, PodName=Name, ControllerKind, ControllerName, Namespace
+          | distinct *
+      ) on ContainerID
+      | summarize count_ = sum(_BilledSize) by  Namespace
+      | project Namespace, count_ = (todouble(count_) / 3600)
+    timespan: PT1H
+    fields:
+      -
+        name: Namespace
+        target: sourceNamespace
+        type: id
+      -
+        name: count_
+        type: value
+    defaultField:
+      type: ignore

example.yaml

@@ -1,14 +1,38 @@
 queries:
+  #########################################################
+  ## rows metric for tables (per second)
+  - metric: azure_metrics_loganalytics_ingestion_overall_rows
+    query: |-
+      union withsource=sourceTable *
+      | project sourceTable
+      | summarize count_ = count() by sourceTable
+      | project sourceTable, count_ = (todouble(count_) / 3600)
+    timespan: PT1H
+    fields:
+      -
+        name: sourceTable
+        type: id
+      -
+        name: count_
+        type: value
+    defaultField:
+      type: ignore
 
-    # name of metric
-  - metric: azure_loganalytics_operationstatus_count
-
-    # Azure ResourceGraph query
+  #########################################################
+  ## bytes metric for tables (per second)
+  - metric: azure_metrics_loganalytics_ingestion_overall_bytes
     query: |-
-      Operation
-      | summarize count() by OperationStatus
-    timespan: PT24H
+      union withsource=sourceTable *
+      | where _IsBillable == true
+      | summarize count_ = sum(_BilledSize) by sourceTable
+      | project sourceTable, count_ = (todouble(count_) / 3600)
+    timespan: PT1H
     fields:
+      -
+        name: sourceTable
+        type: id
       -
         name: count_
         type: value
+    defaultField:
+      type: ignore