kql

Kusto Query Language (KQL)

What it is

KQL (Kusto Query Language) is the query language used to retrieve and analyze data from Log Analytics workspaces (and other Azure Monitor/Application Insights log stores). It’s how you turn raw log rows into meaningful analysis.

Why it exists

Log tables can hold millions of rows. KQL gives a fast, expressive, pipe-based way to filter, aggregate, join, sort, and visualize that data without writing heavy code.

Key ideas

• Pipe operator | chains steps: each operator takes the record set and outputs a transformed one.
• Core operators: where (filter), project (pick columns), summarize (aggregate, e.g. count(), sum(), avg() by a group), sort/order, take/limit, join, extend.
• Time filtering: | where TimeGenerated > ago(1d); grouping: | summarize count() by Computer.
• render timechart / table / barchart / piechart to visualize.
• Great for log-alert rules: the query’s result set triggers an alert when it returns rows/matches a threshold.

Example (memorize the shape)

AzureActivity
| where OperationNameValue contains "virtualMachines"
| where ActivityStatus == "Succeeded"
| summarize ActivityCount = count() by Resource, bin(TimeGenerated, 1h)
| order by ActivityCount desc

How it fits (diagram)

Exam notes

• Learn the pipe | and the core operators — exam lab questions often ask to “filter X with KQL.”
• where = filter rows; project = select columns; summarize ... by ... = group + aggregate; bin() for time buckets.
• Understand the difference between the three alert signals: KQL/log alert (query), metric alert (numeric), activity-log alert (event).

Related

log-analytics · azure-monitor · metric-alert · azure-monitor-activity-log · Home

📘 Source: Microsoft Learn — Kql