Azure Data Explorer (Kusto) Query & Analytics
Execute KQL queries against Azure Data Explorer for fast, scalable big-data
analytics on log, telemetry, and time-series data.
Prerequisites
- Azure CLI authenticated (
az login) with a subscription containing Kusto resources
- RBAC:
AllDatabasesViewer on the cluster, or Database Viewer per database
- Azure MCP server configured in
.vscode/mcp.json for the mcp_azure-mcp_kusto
namespace; CLI fallback in
references/fallback-strategy.md
Steps
- Discover resources — list clusters and databases in the subscription
- Explore schema —
kusto_table_schema_get for table structure
- Query data —
kusto_query with a KQL expression
- Analyse results — aggregate, visualise, export
Query Patterns Quick Reference
| Pattern |
Use For |
| Basic Data Retrieval |
Quick inspection, recent events |
| Aggregation Analysis |
Counting, distribution, top-N |
| Time Series Analytics |
Performance monitoring, trends |
| Join and Correlation |
Root-cause analysis, event tracing |
| Schema Discovery |
Data model exploration |
For full KQL syntax, examples, best practices, and performance tips, read
references/query-patterns.md.
Rules
- Always include a time-range filter (
where Timestamp > ago(...)) on time-series tables
- Use
take/limit for exploratory queries
- Filter early (
where before join / summarize)
- Use
summarize for aggregations; bin() for time bucketing
- Use
project to select only needed columns
MCP Tools
| Tool |
Purpose |
kusto_cluster_list |
List Kusto clusters in a subscription |
kusto_database_list |
List databases in a cluster |
kusto_query |
Execute KQL against a database |
kusto_table_schema_get |
Retrieve table schema |
Required parameters: subscription, cluster, database, query (or table).
Optional: resource-group, tenant.
For CLI fallback (timeouts, auth failures), read
references/fallback-strategy.md.
Reference Index
| Reference |
When to Load |
references/query-patterns.md |
KQL patterns, examples, best practices, common functions |
references/fallback-strategy.md |
CLI commands and REST API fallback when MCP tools fail |
1---2name: azure-kusto3description: **ANALYSIS SKILL** — Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL. WHEN: "KQL queries", "Kusto database queries", "Azure Data Explorer", "ADX clusters", "time series data", "IoT telemetry", "anomaly detection". DO NOT USE FOR: App Insights / Log Analytics troubleshooting (azure-diagnostics), cost analysis (azure-cost-optimization).4license: MIT5---67# Azure Data Explorer (Kusto) Query & Analytics89Execute KQL queries against Azure Data Explorer for fast, scalable big-data10analytics on log, telemetry, and time-series data.1112## Prerequisites1314- **Azure CLI** authenticated (`az login`) with a subscription containing Kusto resources15- **RBAC**: `AllDatabasesViewer` on the cluster, or `Database Viewer` per database16- **Azure MCP server** configured in `.vscode/mcp.json` for the `mcp_azure-mcp_kusto`17 namespace; CLI fallback in18 [`references/fallback-strategy.md`](references/fallback-strategy.md)1920## Steps21221. **Discover resources** — list clusters and databases in the subscription232. **Explore schema** — `kusto_table_schema_get` for table structure243. **Query data** — `kusto_query` with a KQL expression254. **Analyse results** — aggregate, visualise, export2627## Query Patterns Quick Reference2829| Pattern | Use For |30| --------------------- | ---------------------------------- |31| Basic Data Retrieval | Quick inspection, recent events |32| Aggregation Analysis | Counting, distribution, top-N |33| Time Series Analytics | Performance monitoring, trends |34| Join and Correlation | Root-cause analysis, event tracing |35| Schema Discovery | Data model exploration |3637For full KQL syntax, examples, best practices, and performance tips, read38[`references/query-patterns.md`](references/query-patterns.md).3940## Rules4142- Always include a time-range filter (`where Timestamp > ago(...)`) on time-series tables43- Use `take`/`limit` for exploratory queries44- Filter early (`where` before `join` / `summarize`)45- Use `summarize` for aggregations; `bin()` for time bucketing46- Use `project` to select only needed columns4748## MCP Tools4950| Tool | Purpose |51| ------------------------ | ------------------------------------------------------- |52| `kusto_cluster_list` | List Kusto clusters in a subscription |53| `kusto_database_list` | List databases in a cluster |54| `kusto_query` | Execute KQL against a database |55| `kusto_table_schema_get` | Retrieve table schema |5657Required parameters: `subscription`, `cluster`, `database`, `query` (or `table`).58Optional: `resource-group`, `tenant`.5960For CLI fallback (timeouts, auth failures), read61[`references/fallback-strategy.md`](references/fallback-strategy.md).6263## Reference Index6465| Reference | When to Load |66| --------------------------------- | -------------------------------------------------------- |67| `references/query-patterns.md` | KQL patterns, examples, best practices, common functions |68| `references/fallback-strategy.md` | CLI commands and REST API fallback when MCP tools fail |