Enrich existing ContainerLog records without dropping rows that lack inventory matches

Source facts

Azure Monitor’s ContainerLog troubleshooting guidance explains that Image and Name are not populated on every log line by default. It retrieves Image and ImageTag from ContainerInventory, and the name from KubePodInventory’s ContainerName, matching by ContainerID. The example uses left-outer joins so logs survive missing inventory metadata. Microsoft discourages enabling per-line enrichment on clusters above fifty nodes because it adds API-server calls and increases each collected line’s size. Microsoft Learn.

Applicability

This is a query review for existing ContainerLog data, not a recommendation to deploy that schema for new collection. Start by confirming the actual table and the inventory records available for the investigation’s time range.

DSE recommendation

Preserve the original log population while adding inventory context, and keep unmatched metadata explicitly unavailable. Review the ContainerID relationship and time selection instead of silently substituting a current container name. Have the query owner state whether the chosen inventory row is appropriate for the historical question. Avoid enabling broader collection merely to make a report look complete.

Verification

Compare the un-enriched and enriched log counts using a fixed scope and time range. Inspect examples with matching inventory, missing inventory and multiple inventory observations. Confirm the result neither loses original events nor multiplies them unexpectedly through the join. Keep the selected matching logic and unmatched rows visible in the review evidence. A populated name should represent the chosen inventory relationship, not an unsupported claim about every event’s original runtime context.

Official references

Microsoft Learn: Container log troubleshooting. Source reviewed September 9, 2026.