Budget alert: the Azure monitoring bill has been multiplied by 40 in five days

This morning, MasterLinux's finance department received the alert from the budget-prod-mensuel budget: 90% of the October budget consumed by the 20th of the month. The cost breakdown points to a single line: the Log Analytics workspace law-masterlinux-prod (group rg-supervision), which usually cost about 130 dirhams a day and now costs more than 4,900.

This workspace receives the logs of the AKS cluster aks-boutique-prod (Container insights), the Application Gateway diagnostics and the Microsoft Defender for Cloud data. Last Thursday, version 4.13.0 of the commandes API was put into production; the security team states it has changed nothing in Defender.

Every hour that passes costs about 200 dirhams. The operations manager asks you to find what is ingesting so much, to stop it without losing monitoring, and to make sure it does not happen again.

You are on your workstation with Azure CLI and kubectl (context aks-boutique-prod). The workspace ID (customerId) is 4b7e2c19-0d8a-4f63-9e51-a2c6b8f3d074.