kql

What it does

The skill teaches correct, efficient Kusto Query Language (KQL) query construction and troubleshooting. It stresses avoiding common gotchas, especially around dynamic types, join patterns, serialization, memory usage, and result-size discipline. It also covers advanced functions (geo, vector, graph) and regex-related patterns, with emphasis on when to apply specific casts, pre-filtering, and careful handling of pipe-forward syntax.

How it works

The content explains KQL as a pipe-forward language and distinguishes between Query and Management planes. It details:

• Dynamic Type Discipline: casting dynamic columns in by, on, or order by using explicit casts like tostring(), tolong(), or todouble().
• Join Patterns & Pitfalls: only equality in join predicates, explicit left/right attribute references, and cardinality checks before large joins; guidance on pre-binning ranges.
• Regex in KQL: proper use of extract_all with capturing groups and various regex functions.
• Serialization Requirements: serialize or order by before windowing functions such as row_cumsum(), row_number(), etc.
• Memory-Safe Query Patterns: steps to reduce memory usage (count, where first, avoid high-cardinality dcount, check join cardinality, materialize for reused subqueries).
• Result Size Discipline: end exploratory queries with take, top, or project only essential columns; caution with large vectors.
• String Comparison Strictness: casting both sides for computed strings.
• Advanced Functions: examples for vector similarity, geo operations, graph queries, and time series.
• Self-Correction Lookup Table: mapping common errors to fixes like dynamic casting, pre-binning, or serialization.

When to use it

Use this skill whenever writing, debugging, or reviewing KQL queries to prevent common errors and avoid expensive retries.

What it can touch

The skill references KQL operators, functions, and patterns, including dynamic casting and serialization strategies, but does not specify external tools beyond KQL context. It does not enumerate executable tool invocations beyond the examples provided within the KQL context.

Caveats

The material focuses on recommended practices and common error messages (e.g., dynamic type issues, exclusive join predicates, serialization requirements) but does not guarantee specific outcomes. It adheres to KQL syntax rules and demonstrates fixes rather than asserting end-to-end results.