Lesson238 words
Kusto Query Language
Interrogate logs using basic Kusto Query Language queries
The shape
A KQL query starts with a table and pipes it through operators:
kusto
requests
| where timestamp > ago(24h)
| where success == false
| summarize failures = count() by name, bin(timestamp, 1h)
| order by failures desc
| take 20Read it top to bottom: source → filter → aggregate → order → limit. Recognising that shape matters more than memorising operators, because almost every practical query follows it.
The operators worth knowing
| Operator | Does |
|---|---|
where | Filter rows |
summarize | Aggregate — count(), avg(), percentile() |
bin() | Bucket a timestamp into intervals, for time series |
project | Choose columns |
extend | Add a calculated column |
join | Combine tables |
order by / take | Sort and limit |
Filter early
Put where as close to the source as possible. Filtering before aggregating reduces the data scanned, which matters for both speed and cost on a large workspace — and a time filter is nearly always the most valuable one.
Percentiles
kusto
requests
| summarize p95 = percentile(duration, 95), p99 = percentile(duration, 99) by nameThis is the query behind the earlier point that averages hide the tail. Reporting p95 and p99 by operation is the standard latency view.
Primary sources