diff --git a/test/cmd/testdata/zz_fixture_TestGeneratedHTMLWithoutStepsUsesTimingFallbackcustom_link_tools_test_table.html b/test/cmd/testdata/zz_fixture_TestGeneratedHTMLWithoutStepsUsesTimingFallbackcustom_link_tools_test_table.html
index be02774f1b5..e7cd4a5b282 100644
--- a/test/cmd/testdata/zz_fixture_TestGeneratedHTMLWithoutStepsUsesTimingFallbackcustom_link_tools_test_table.html
+++ b/test/cmd/testdata/zz_fixture_TestGeneratedHTMLWithoutStepsUsesTimingFallbackcustom_link_tools_test_table.html
@@ -78,7 +78,7 @@
Hosted Control Plane Logs
- Service Logs
+ Service Logs
Debug Queries
diff --git a/test/cmd/testdata/zz_fixture_TestGeneratedHTMLcustom_link_tools_test_table.html b/test/cmd/testdata/zz_fixture_TestGeneratedHTMLcustom_link_tools_test_table.html
index be02774f1b5..e7cd4a5b282 100644
--- a/test/cmd/testdata/zz_fixture_TestGeneratedHTMLcustom_link_tools_test_table.html
+++ b/test/cmd/testdata/zz_fixture_TestGeneratedHTMLcustom_link_tools_test_table.html
@@ -78,7 +78,7 @@
Hosted Control Plane Logs
- Service Logs
+ Service Logs
Debug Queries
diff --git a/tooling/hcpctl/pkg/kusto/templates/custom/detailed_infra_orchestration_logs.kql.gotmpl b/tooling/hcpctl/pkg/kusto/templates/custom/detailed_infra_orchestration_logs.kql.gotmpl
index 17009a22023..dff43087b34 100644
--- a/tooling/hcpctl/pkg/kusto/templates/custom/detailed_infra_orchestration_logs.kql.gotmpl
+++ b/tooling/hcpctl/pkg/kusto/templates/custom/detailed_infra_orchestration_logs.kql.gotmpl
@@ -14,6 +14,7 @@ let maestro_resource_ids = (
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| extend resourceId = extract(@'resourceid[=:"]+([a-f0-9\-]+)', 1, logStr)
@@ -28,8 +29,22 @@ union
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
- | where logStr has cluster_id or logStr has_any (maestro_resource_ids)
+ | where logStr has cluster_id
+ | project timestamp, container_name, msg = logStr, log
+ ),
+ (
+ // Maestro logs: operations on associated resource IDs (joined to avoid has_any limit)
+ database('ServiceLogs').table('containerLogs')
+ | where timestamp between (_startTime .. _endTime)
+ | where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
+ | extend logStr = tostring(log)
+ | extend resourceId = extract(@'resourceid[=:"]+([a-f0-9\-]+)', 1, logStr)
+ | where isnotempty(resourceId)
+ | where not(logStr has cluster_id)
+ | join kind=inner (maestro_resource_ids) on resourceId
| project timestamp, container_name, msg = logStr, log
),
(
@@ -38,6 +53,7 @@ union
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "hypershift"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| project timestamp, container_name, msg = logStr, log
@@ -48,6 +64,7 @@ union
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "open-cluster-management-agent"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| project timestamp, container_name, msg = logStr, log
diff --git a/tooling/hcpctl/testdata/zz_fixture_TestBuildAllCustomQueries.yaml b/tooling/hcpctl/testdata/zz_fixture_TestBuildAllCustomQueries.yaml
index c7495a4bbc0..50c5e626410 100644
--- a/tooling/hcpctl/testdata/zz_fixture_TestBuildAllCustomQueries.yaml
+++ b/tooling/hcpctl/testdata/zz_fixture_TestBuildAllCustomQueries.yaml
@@ -209,6 +209,7 @@
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| extend resourceId = extract(@'resourceid[=:"]+([a-f0-9\-]+)', 1, logStr)
@@ -223,8 +224,22 @@
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
- | where logStr has cluster_id or logStr has_any (maestro_resource_ids)
+ | where logStr has cluster_id
+ | project timestamp, container_name, msg = logStr, log
+ ),
+ (
+ // Maestro logs: operations on associated resource IDs (joined to avoid has_any limit)
+ database('ServiceLogs').table('containerLogs')
+ | where timestamp between (_startTime .. _endTime)
+ | where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
+ | extend logStr = tostring(log)
+ | extend resourceId = extract(@'resourceid[=:"]+([a-f0-9\-]+)', 1, logStr)
+ | where isnotempty(resourceId)
+ | where not(logStr has cluster_id)
+ | join kind=inner (maestro_resource_ids) on resourceId
| project timestamp, container_name, msg = logStr, log
),
(
@@ -233,6 +248,7 @@
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "hypershift"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| project timestamp, container_name, msg = logStr, log
@@ -243,6 +259,7 @@
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "open-cluster-management-agent"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| project timestamp, container_name, msg = logStr, log
diff --git a/tooling/hcpctl/testdata/zz_fixture_TestBuildMerged_MultipleChildren.yaml b/tooling/hcpctl/testdata/zz_fixture_TestBuildMerged_MultipleChildren.yaml
index 445ff595ded..951bf6549ac 100644
--- a/tooling/hcpctl/testdata/zz_fixture_TestBuildMerged_MultipleChildren.yaml
+++ b/tooling/hcpctl/testdata/zz_fixture_TestBuildMerged_MultipleChildren.yaml
@@ -73,6 +73,7 @@ kql: |-
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| extend resourceId = extract(@'resourceid[=:"]+([a-f0-9\-]+)', 1, logStr)
@@ -87,8 +88,22 @@ kql: |-
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
- | where logStr has cluster_id or logStr has_any (maestro_resource_ids)
+ | where logStr has cluster_id
+ | project timestamp, container_name, msg = logStr, log
+ ),
+ (
+ // Maestro logs: operations on associated resource IDs (joined to avoid has_any limit)
+ database('ServiceLogs').table('containerLogs')
+ | where timestamp between (_startTime .. _endTime)
+ | where namespace_name has "maestro"
+ | where isnotempty(cluster_id)
+ | extend logStr = tostring(log)
+ | extend resourceId = extract(@'resourceid[=:"]+([a-f0-9\-]+)', 1, logStr)
+ | where isnotempty(resourceId)
+ | where not(logStr has cluster_id)
+ | join kind=inner (maestro_resource_ids) on resourceId
| project timestamp, container_name, msg = logStr, log
),
(
@@ -97,6 +112,7 @@ kql: |-
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "hypershift"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| project timestamp, container_name, msg = logStr, log
@@ -107,6 +123,7 @@ kql: |-
database('ServiceLogs').table('containerLogs')
| where timestamp between (_startTime .. _endTime)
| where namespace_name has "open-cluster-management-agent"
+ | where isnotempty(cluster_id)
| extend logStr = tostring(log)
| where logStr has cluster_id
| project timestamp, container_name, msg = logStr, log