Forum Discussion
MicrosoftWhich is efficient query - project after where (or) where after project
I query log analytics table (which has huge number of records) from workbook
This table - Azure Diagnostics - will have columns from other Azure RP as well.
To make my query efficient, I looked at kusto best practice and made query changes.
When I first fetch table, I always use time filter first. However, after first time filter, I am not sure If I have to subsequent 'where' filters or narrow down the columns using 'project'. The reason being AzureDiagnostics table tend to have lot more columns than what is ingested from my service and hence I need to narrow down.
Hence question is after time filter,
should I use where filters after project (or) project after where filters.?
3 Replies
Vino55Thanks Deleted for the response.
The best practice for LA query remains same as Kusto?
Since LA is on top of Kusto, is there some layering over KQL which requires different set of rules/recommendation for better optimization.
https://docs.microsoft.com/en-gb/azure/azure-monitor/log-query/query-language
"Azure Monitor logs are built on Azure Data Explorer, and Azure Monitor log queries use a version of the same Kusto query language. The Kusto query language documentation has all of the details for the language and should be your primary resource for writing Azure Monitor log queries. This page provides links to other resources for learning how to write queries and on differences with the Azure Monitor implementation of the language."
