Quartz 5

kql

Properties2
tagsmonitoring, log-analytics, kql, query
aliasesKQL, Kusto queries

2 min read

Kusto Query Language (KQL)

What it is

Kusto Query Language (KQL) is a read-only query language for exploring structured, semi-structured, and unstructured data. In Azure Monitor, people use it to ask questions of log tables in Log Analytics workspaces and Application Insights data.

Why it exists

Logs can contain far more records than a person can read. KQL turns the question into a sequence of small steps: start with a table, filter it, select useful fields, group it, and inspect the result. A KQL query reads data; it does not change the log records it examines.

Key ideas

  • Pipe operator | chains steps: each operator receives a table-like result and produces the next one. Read it left to right as a funnel.
  • Core operators: where (filter), project (pick columns), summarize (aggregate, e.g. count(), sum(), avg() by a group), sort/order, take/limit, join, extend.
  • Time is usually the first filter. For example, | where TimeGenerated > ago(1d) limits results to the last day; | summarize count() by Computer counts records for each machine.
  • render can show compatible results as a chart. A saved query can also become a log search alert when its configured evaluation meets the alert condition.

Northwind example

Northwind wants to know whether an order-service deployment caused errors. The team starts with the application’s table, limits the time range to the deployment window, filters to failed requests, and groups by error code. The result is an evidence-based answer, not a guess:

AppRequests
| where TimeGenerated > ago(2h)
| where Success == false
| summarize FailedRequests = count() by ResultCode, bin(TimeGenerated, 15m)
| order by TimeGenerated desc

How it fits (diagram)

Exam notes

  • where filters rows; project selects columns; summarize ... by ... groups and aggregates; bin() forms time buckets.
  • The order of pipe steps matters to both the answer and query performance.
  • KQL/log alerts use query results; metric alerts use numeric time-series data; activity-log alerts use management events.

log-analytics · azure-monitor · metric-alert · azure-monitor-activity-log · Home

📘 Sources: Microsoft Learn — KQL overview · Log Analytics in Azure Monitor

Graph View

Backlinks