azure-kusto
Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clusters, log analytics, time series data, IoT telemetry, anomaly detection.
- Installs
- 566.5K
- Last 24h
- +1.4K
- Trending rank
- #203
- Security
- Warn
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/microsoft/azure-skills --skill azure-kusto- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads azure-kusto automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Azure Data Explorer (Kusto) Query & Analytics
Execute KQL queries and manage Azure Data Explorer resources for fast, scalable big data analytics on log, telemetry, and time series data.
Overview
This skill enables querying and managing Azure Data Explorer (Kusto), a fast and highly scalable data exploration service optimized for log and telemetry data. Azure Data Explorer provides sub-second query performance on billions of records using the Kusto Query Language (KQL).
Key capabilities:
- Query Execution: Run KQL queries against massive datasets
- Schema Exploration: Discover tables, columns, and data types
- Resource Management: List clusters and databases
- Analytics: Aggregations, time series, anomaly detection, machine learning
Core Workflow
- Discover Resources: List available clusters and databases in subscription. If the target table's location is unknown and multiple candidate clusters, databases, or Log Analytics workspaces exist, batch the search (see Pattern 6) and only report "not found" after all candidates are checked.
- Explore Schema: Retrieve table structures to understand data model
- Query Data: Execute KQL queries for analysis, filtering, aggregation
- Analyze Results: Process query output for insights and reporting
Query Patterns
Pattern 1: Basic Data Retrieval
Fetch recent records from a table with simple filtering.
Example KQL:
Events
| where Timestamp > ago(1h)
| take 100
Use for: Quick data inspection, recent event retrieval
Pattern 2: Aggregation Analysis
Summarize data by dimensions for insights and reporting.
Example KQL:
Events
| summarize count() by EventType, bin(Timestamp, 1h)
| order by count_ desc
Use for: Event counting, distribution analysis, top-N queries
Pattern 3: Time Series Analytics
Analyze data over time windows for trends and patterns.
Example KQL:
Telemetry
| where Timestamp > ago(24h)
| summarize avg(ResponseTime), percentiles(ResponseTime, 50, 95, 99) by bin(Timestamp, 5m)
| render timechart
Use for: Performance monitoring, trend analysis, anomaly detection
Pattern 4: Join and Correlation
Combine multiple tables for cross-dataset analysis.
Example KQL:
Events
| where EventType == "Error"
| join kind=inner (
Logs
| where Severity == "Critical"
) on CorrelationId
| project Timestamp, EventType, LogMessage, Severity
Use for: Root cause analysis, correlated event tracking
Pattern 5: Schema Discovery
Explore table structure before querying.
Tools: kusto_table_schema_get
Use for: Understanding data model, query planning
Pattern 6: Batch Search Across Candidate Sources
When a table's location is unknown and there are several candidate clusters, databases, or workspaces, batch read-only metadata discovery instead of querying candidates one at a time. List tables in each candidate database or workspace and match the exact table name before querying data.
After confirming which sources contain the table, query those sources together when needed:
union workspace('ws1').Requests, workspace('ws2').Requests
| take 1
Use for: Locating a table among many candidate resources without confusing an empty result with a missing table
Key Data Fields
When executing queries, common field patterns:
- Timestamp: Time of event (datetime) - use
ago(),between(),bin()for time filtering - EventType/Category: Classification field for grouping
- CorrelationId/SessionId: For tracing related events
- Severity/Level: For filtering by importance
- Dimensions: Custom properties for grouping and filtering
Result Format
Query results include:
- Columns: Field names and data types
- Rows: Data records matching query
- Statistics: Row count, execution time, resource utilization
- Visualization: Chart rendering hints (timechart, barchart, etc.)
KQL Best Practices
🔵 Query Patterns:
- Use
summarizefor aggregations instead ofcount()alone - Use
bin()for time bucketing in time series - Use
projectto select only needed columns - Use
extendto add calculated fields
🟡 Common Functions:
ago(timespan): Relative time (ago(1h), ago(7d))between(start .. end): Range filteringstartswith(),contains(),matches regex: String filteringparse,extract: Extract values from stringspercentiles(),avg(),sum(),max(),min(): Aggregations
Best Practices
- Filter early with time range filters to optimize query performance and use indexed columns first
- Use
takeorlimitfor exploratory queries to avoid large result sets - Leverage
summarizefor aggregations instead of client-side processing - Store frequently-used queries as functions in the database
- Use materialized views for repeated aggregations
- Monitor query performance and resource consumption
- Apply data retention policies to manage storage costs
- Use streaming ingestion for real-time analytics (< 1 second latency)
- Integrate with Azure Monitor for operational insights
MCP Tools Used
| Tool | Purpose |
|---|---|
kusto_cluster_list | List all Azure Data Explorer clusters in a subscription |
kusto_database_list | List all databases in a specific Kusto cluster |
kusto_query | Execute KQL queries against a Kusto database |
kusto_table_schema_get | Retrieve schema information for a specific table |
Required Parameters:
subscription: Azure subscription ID or display namecluster: Kusto cluster name (e.g., "mycluster")database: Database namequery: KQL query string (for query operations)table: Table name (for schema operations)
Optional Parameters:
resource-group: Resource group name (for listing operations)tenant: Azure AD tenant ID
Fallback Strategy: Azure CLI Commands
If Azure MCP Kusto tools fail, timeout, or are unavailable, use Azure CLI commands as fallback.
CLI Command Reference
| Operation | Azure CLI Command |
|---|---|
| List clusters | az kusto cluster list --resource-group <rg-name> |
| List databases | az kusto database list --cluster-name <cluster> --resource-group <rg-name> |
| Show cluster | az kusto cluster show --name <cluster> --resource-group <rg-name> |
| Show database | az kusto database show --cluster-name <cluster> --database-name <db> --resource-group <rg-name> |
KQL Query via Azure CLI
For queries, use the Kusto REST API or direct cluster URL:
az rest --method post \
--url "https://<cluster>.<region>.kusto.windows.net/v1/rest/query" \
--body "{ \"db\": \"<database>\", \"csl\": \"<kql-query>\" }"
When to Fallback
Switch to Azure CLI when:
- MCP tool returns timeout error (queries > 60 seconds)
- MCP tool returns "service unavailable" or connection errors
- Authentication failures with MCP tools
- Empty response when database is known to have data
Common Issues
- Access Denied: Verify database permissions (Viewer role minimum for queries)
- Query Timeout: Optimize query with time filters, reduce result set, or increase timeout
- Syntax Error: Validate KQL syntax - common issues: missing pipes, incorrect operators
- Empty Results: Check time range filters (may be too restrictive), verify table name
- Table Location Unknown: Use Pattern 6 to batch-search all candidate sources before concluding the data does not exist
- Cluster Not Found: Check cluster name format (exclude ".kusto.windows.net" suffix)
- High CPU Usage: Query too broad - add filters, reduce time range, limit aggregations
- Ingestion Lag: Streaming data may have 1-30 second delay depending on ingestion method
Use Cases
- Log Analytics: Application logs, system logs, audit logs
- IoT Analytics: Sensor data, device telemetry, real-time monitoring
- Security Analytics: SIEM data, threat detection, security event correlation
- APM: Application performance metrics, user behavior, error tracking
- Business Intelligence: Clickstream analysis, user analytics, operational KPIs
FAQ
What does the azure-kusto skill do?
Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clusters, log analytics, time series data, IoT telemetry, anomaly detection.
How do I install azure-kusto?
Run npx skills add https://github.com/microsoft/azure-skills --skill azure-kusto in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/azure-kusto/ (personal) or .claude/skills/azure-kusto/ (project).
Which AI agents can use azure-kusto?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is azure-kusto safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk flagged items to review; Runlayer flagged items to review; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains azure-kusto?
It is published by microsoft in microsoft/azure-skills, and it is an official skill from the maker of the technology it covers. It has 566,474 recorded installs.
More from microsoft/azure-skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.
Popular devops & cloud skills
wizard
mattpocock/skills
Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.
google-agents-cli-deploy
google/agents-cli
This skill should be used when the user wants to "deploy an agent", "deploy my ADK agent", "set up CI/CD", "configure secrets", "troubleshoot a deployment", or needs guidance on Agent Runtime, Cloud Run, or GKE deployment targets, or binding an agent to an Agent Gateway. Covers deployment workflows, service accounts, rollback, and production infrastructure. Applies to any framework agents-cli deploys (ADK, LangChain, ...). Part of the agents-cli skills suite. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), evaluation (use google-agents-cli-eval), or project scaffolding (use google-agents-cli-scaffold).
google-agents-cli-scaffold
google/agents-cli
This skill should be used when the user wants to "create an agent project", "start a new ADK project", "build me a new agent", "add CI/CD to my project", "add deployment", "enhance my project", or "upgrade my project". Part of the agents-cli skills suite. Covers agents-cli scaffold create, scaffold enhance, and scaffold upgrade commands, template options, deployment targets, and the prototype-first workflow. Do NOT use for writing agent code (ADK projects: use google-agents-cli-adk-code) or deployment operations (use google-agents-cli-deploy).
google-agents-cli-observability
google/agents-cli
This skill should be used when the user wants to "set up tracing", "monitor my agent", "configure logging", "add observability", "debug production traffic", or needs guidance on monitoring deployed agents, including ADK (Agent Development Kit) agents. Covers Cloud Trace, prompt-response logging, BigQuery Agent Analytics, third-party integrations (AgentOps, Phoenix, MLflow, etc.), and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment setup (use google-agents-cli-deploy) or API code patterns (use google-agents-cli-adk-code).
vercel-composition-patterns
vercel-labs/agent-skills
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.
sentry-cli
sentry/dev
Guide for using the Sentry CLI to interact with Sentry from the command line. Use when the user asks about viewing issues, events, projects, organizations, making API calls, or authenticating with Sentry via CLI.