{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "slug": "dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory", "url": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/" }, "title": "Enrich existing ContainerLog records without dropping rows that lack inventory matches", "summary": "How should missing Image and Name values be recovered when querying existing ContainerLog records?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:32+00:00", "modified_at": "2026-09-10T01:20:45+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 248, "potentially_affected": "Existing Azure Monitor ContainerLog records with omitted image or container-name fields and associated inventory tables.", "dse_recommendation": "Preserve the original log population while adding inventory context, and keep unmatched metadata explicitly unavailable.", "primary_source": { "name": "Troubleshoot collection of container logs in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-troubleshoot", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Monitor’s ContainerLog troubleshooting guidance explains that Image and Name are not populated on every log line by default. It retrieves Image and ImageTag from ContainerInventory, and the name from KubePodInventory’s ContainerName, matching by ContainerID. The example uses left-outer joins so logs survive missing inventory metadata. Microsoft discourages enabling per-line enrichment on clusters above fifty nodes because it adds API-server calls and increases each collected line’s size. Microsoft Learn.

\n

Applicability

\n

This is a query review for existing ContainerLog data, not a recommendation to deploy that schema for new collection. Start by confirming the actual table and the inventory records available for the investigation’s time range.

\n

DSE recommendation

\n

Preserve the original log population while adding inventory context, and keep unmatched metadata explicitly unavailable. Review the ContainerID relationship and time selection instead of silently substituting a current container name. Have the query owner state whether the chosen inventory row is appropriate for the historical question. Avoid enabling broader collection merely to make a report look complete.

\n

Verification

\n

Compare the un-enriched and enriched log counts using a fixed scope and time range. Inspect examples with matching inventory, missing inventory and multiple inventory observations. Confirm the result neither loses original events nor multiplies them unexpectedly through the join. Keep the selected matching logic and unmatched rows visible in the review evidence. A populated name should represent the chosen inventory relationship, not an unsupported claim about every event’s original runtime context.

\n

Official references

\n

Microsoft Learn: Container log troubleshooting. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Monitor’s ContainerLog troubleshooting guidance explains that Image and Name are not populated on every log line by default. It retrieves Image and ImageTag from ContainerInventory, and the name from KubePodInventory’s ContainerName, matching by ContainerID. The example uses left-outer joins so logs survive missing inventory metadata. Microsoft discourages enabling per-line enrichment on clusters above fifty nodes because it adds API-server calls and increases each collected line’s size. Microsoft Learn.\nApplicability\nThis is a query review for existing ContainerLog data, not a recommendation to deploy that schema for new collection. Start by confirming the actual table and the inventory records available for the investigation’s time range.\nDSE recommendation\nPreserve the original log population while adding inventory context, and keep unmatched metadata explicitly unavailable. Review the ContainerID relationship and time selection instead of silently substituting a current container name. Have the query owner state whether the chosen inventory row is appropriate for the historical question. Avoid enabling broader collection merely to make a report look complete.\nVerification\nCompare the un-enriched and enriched log counts using a fixed scope and time range. Inspect examples with matching inventory, missing inventory and multiple inventory observations. Confirm the result neither loses original events nor multiplies them unexpectedly through the join. Keep the selected matching logic and unmatched rows visible in the review evidence. A populated name should represent the chosen inventory relationship, not an unsupported claim about every event’s original runtime context.\nOfficial references\nMicrosoft Learn: Container log troubleshooting. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Monitor’s ContainerLog troubleshooting guidance explains that Image and Name are not populated on every log line by default. It retrieves Image and ImageTag from ContainerInventory, and the name from KubePodInventory’s ContainerName, matching by ContainerID. The example uses left-outer joins so logs survive missing inventory metadata. Microsoft discourages enabling per-line enrichment on clusters above fifty nodes because it adds API-server calls and increases each collected line’s size. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-troubleshoot).\n\n## Applicability\n\nThis is a query review for existing ContainerLog data, not a recommendation to deploy that schema for new collection. Start by confirming the actual table and the inventory records available for the investigation’s time range.\n\n## DSE recommendation\n\nPreserve the original log population while adding inventory context, and keep unmatched metadata explicitly unavailable. Review the ContainerID relationship and time selection instead of silently substituting a current container name. Have the query owner state whether the chosen inventory row is appropriate for the historical question. Avoid enabling broader collection merely to make a report look complete.\n\n## Verification\n\nCompare the un-enriched and enriched log counts using a fixed scope and time range. Inspect examples with matching inventory, missing inventory and multiple inventory observations. Confirm the result neither loses original events nor multiplies them unexpectedly through the join. Keep the selected matching logic and unmatched rows visible in the review evidence. A populated name should represent the chosen inventory relationship, not an unsupported claim about every event’s original runtime context.\n\n## Official references\n\n[Microsoft Learn: Container log troubleshooting](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-troubleshoot). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "url": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Enrich existing ContainerLog records without dropping rows that lack inventory matches", "item": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "url": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/", "headline": "Enrich existing ContainerLog records without dropping rows that lack inventory matches", "description": "How should missing Image and Name values be recovered when querying existing ContainerLog records?", "abstract": "How should missing Image and Name values be recovered when querying existing ContainerLog records?", "articleBody": "Source facts\nAzure Monitor’s ContainerLog troubleshooting guidance explains that Image and Name are not populated on every log line by default. It retrieves Image and ImageTag from ContainerInventory, and the name from KubePodInventory’s ContainerName, matching by ContainerID. The example uses left-outer joins so logs survive missing inventory metadata. Microsoft discourages enabling per-line enrichment on clusters above fifty nodes because it adds API-server calls and increases each collected line’s size. Microsoft Learn.\nApplicability\nThis is a query review for existing ContainerLog data, not a recommendation to deploy that schema for new collection. Start by confirming the actual table and the inventory records available for the investigation’s time range.\nDSE recommendation\nPreserve the original log population while adding inventory context, and keep unmatched metadata explicitly unavailable. Review the ContainerID relationship and time selection instead of silently substituting a current container name. Have the query owner state whether the chosen inventory row is appropriate for the historical question. Avoid enabling broader collection merely to make a report look complete.\nVerification\nCompare the un-enriched and enriched log counts using a fixed scope and time range. Inspect examples with matching inventory, missing inventory and multiple inventory observations. Confirm the result neither loses original events nor multiplies them unexpectedly through the join. Keep the selected matching logic and unmatched rows visible in the review evidence. A populated name should represent the chosen inventory relationship, not an unsupported claim about every event’s original runtime context.\nOfficial references\nMicrosoft Learn: Container log troubleshooting. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:28:32+00:00", "dateModified": "2026-09-10T01:20:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-204-enrich-existing-containerlog-records-without-dropping-rows-that-lack-inventory/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Enrich existing ContainerLog records without dropping rows that lack inventory matches" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot collection of container logs in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-troubleshoot" } } ] } }