Nov 10 2019
11:15 PM
- last edited on
Apr 08 2022
10:12 AM
by
TechCommunityAP
Nov 10 2019
11:15 PM
- last edited on
Apr 08 2022
10:12 AM
by
TechCommunityAP
I query log analytics table (which has huge number of records) from workbook
This table - Azure Diagnostics - will have columns from other Azure RP as well.
To make my query efficient, I looked at kusto best practice and made query changes.
When I first fetch table, I always use time filter first. However, after first time filter, I am not sure If I have to subsequent 'where' filters or narrow down the columns using 'project'. The reason being AzureDiagnostics table tend to have lot more columns than what is ingested from my service and hence I need to narrow down.
Hence question is after time filter,
should I use where filters after project (or) project after where filters.?
Nov 11 2019 11:21 PM
Nov 13 2019 09:50 PM
Thanks @Deleted for the response.
The best practice for LA query remains same as Kusto?
Since LA is on top of Kusto, is there some layering over KQL which requires different set of rules/recommendation for better optimization.
Nov 14 2019 03:20 AM
https://docs.microsoft.com/en-gb/azure/azure-monitor/log-query/query-language
"Azure Monitor logs are built on Azure Data Explorer, and Azure Monitor log queries use a version of the same Kusto query language. The Kusto query language documentation has all of the details for the language and should be your primary resource for writing Azure Monitor log queries. This page provides links to other resources for learning how to write queries and on differences with the Azure Monitor implementation of the language."