Interrogate logs using basic Kusto Query Language queries

The shape

A KQL query starts with a table and pipes it through operators:

kusto

requests
| where timestamp > ago(24h)
| where success == false
| summarize failures = count() by name, bin(timestamp, 1h)
| order by failures desc
| take 20

Read it top to bottom: source → filter → aggregate → order → limit. Recognising that shape matters more than memorising operators, because almost every practical query follows it.

The operators worth knowing

Operator	Does
`where`	Filter rows
`summarize`	Aggregate — `count()`, `avg()`, `percentile()`
`bin()`	Bucket a timestamp into intervals, for time series
`project`	Choose columns
`extend`	Add a calculated column
`join`	Combine tables
`order by` / `take`	Sort and limit

Filter early

Put where as close to the source as possible. Filtering before aggregating reduces the data scanned, which matters for both speed and cost on a large workspace — and a time filter is nearly always the most valuable one.

Percentiles

kusto

requests
| summarize p95 = percentile(duration, 95), p99 = percentile(duration, 99) by name

This is the query behind the earlier point that averages hide the tail. Reporting p95 and p99 by operation is the standard latency view.

Primary sources

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-query-overview