概觀Overview

Kusto 查詢是一種負責處理資料並傳回結果的唯讀要求。A Kusto query is a read-only request to process data and return results. 該要求是採用針對讓語法易於理解、撰寫及自動執行所設計的資料流程模型,並採用純文字加以陳述。The request is stated in plain text, using a data-flow model designed to make the syntax easy to read, author, and automate. 此查詢使用的結構描述實體組織架構類似於 SQL 的階層:資料庫、資料表與資料欄。The query uses schema entities that are organized in a hierarchy similar to SQL's: databases, tables, and columns.

此查詢包含一系列以分號 (;) 分隔的查詢陳述式,其中至少有一個陳述式為表格式運算陳述式,這種陳述式所產生的資料會以類似表格之網格的資料行與資料列方式排列。The query consists of a sequence of query statements, delimited by a semicolon (;), with at least one statement being a tabular expression statement which is a statement that produces data arranged in a table-like mesh of columns and rows. 此查詢的表格式運算陳述式會產生查詢的結果。The query's tabular expression statements produce the results of the query.

此表格式運算陳述式語法中的表格式資料會從某個表格式查詢運算子流到另一個運算子,先從資料來源開始 (例如,資料庫中的資料表,或是會產生資料的運算子),然後流經一組使用管線運算子 (|) 分隔符號繫結在一起的資料轉換運算子。The syntax of the tabular expression statement has tabular data flow from one tabular query operator to another, starting with data source (e.g. a table in a database, or an operator that produces data) and then flowing through a set of data transformation operators that are bound together through the use of the pipe (|) delimiter.

例如,下列 Kusto 查詢會有一個陳述式,亦即表格式運算陳述式。For example, the following Kusto query has a single statement, which is a tabular expression statement. 此陳述式一開始會先參照名為 StormEvents 的資料表 (裝載此資料表的資料庫在此是隱含的,且為連接資訊的一部分)。The statement starts with a reference to a table called StormEvents (the database that host this table is implicit here, and part of the connection information). 接著會篩選資料表的資料 (資料列),先依 StartTime 資料行的值篩選,再以 State 資料行的值篩選。The data (rows) for that table are then filtered by the value of the StartTime column, and then filtered by the value of the State column. 然後查詢會傳回「仍正常運作」的資料列計數。The query then returns the count of "surviving" rows.

StormEvents 
| where StartTime >= datetime(2007-11-01) and StartTime < datetime(2007-12-01)
| where State == "FLORIDA"  
| count 

若要執行此查詢,請按一下這裡To run this query, click here. 在此案例中,結果會是:In this case, the result will be:

CountCount
2323