Hi All,
I'm trying to consume a specific data from the logs content, I am using a filter matchesPhrase or contains but both function is not returning any records through DQL Query API on swagger ui, when I removed those specific filters it return some records, but it does also work via Logs and Events or the Notebooks. I'm not sure if those filtering is not allowed on API. Below is the query that I've been using:
fetch logs , from:now() - 1d | fields DateTime = formatTimestamp(timestamp, format:\"MM-dd-YYYY\"),k8s.container.name,k8s.namespace.name,timestamp,content,ErrorClass=\"Configurator Error\" | filter (matchesValue(k8s.namespace.name, \"p1-extensions\") or matchesValue(k8s.namespace.name, \"p1\")) and matchesPhrase(content, \"Configurator Error\") | sort timestamp desc | summarize count(), alias: Total
