Introduction to Kusto
summary
Kusto (Azure Data Explorer) stores JSON logs, queried with KQL via the web portal or desktop client; DocuSign ingests 1.9 billion events/day and uses KQL operators (where, project, summarize, bin, top-nested) to filter by time, cast JSON fields, and compute averages. They reduce to ~1,000 rows in <2s for interactive debugging, use auto_cluster and series_decompose to detect spikes plus basket grouping to surface common exceptions, render_anomaly_chart for visualization, and wire alerts to Flow/Slack; this workflow finds misconfigured servers causing spikes.
AI-written summary · about
chapters (44)
- 0:00Introduction
- 0:28Julien Lo Presti
- 0:59What is a carrier great company
- 1:33What is a reliable company
- 2:10What is Kusto
- 5:32Web Application
- 6:56School Query
- 7:21Constraints
- 8:07Data
- 8:28Sequel
- 10:05Query Improvements
- 10:49Variables
- 12:37Time
- 13:37API Controller
- 16:00Most Used Controller
- 17:12Beam
- 18:37Variable
- 19:18Action
- 20:23Controller
- 21:31Time window
- 21:58Advanced features
- 23:23Filtering on dates
- 24:27Data points
- 24:50Events
- 25:24Event
- 25:39Basket
- 26:38Auto Cluster
- 31:05Surrey Decomposition
- 31:17Composite decomposition
- 31:47Service
- 32:45New Array
- 33:42Detect
- 34:31Flags
- 35:45Filter
- 36:14MVExpandQL
- 37:01MGExpandQL
- 37:25Pipe
- 38:04Time Pad
- 38:57IAF
- 40:01Microsoft Flow
- 40:34Anomaly Shot
- 41:06Anomaly Chart
- 41:58Crystal
- 42:25Takeaway
related talks
57mStop waiting to explore your data: use Azure Data Explorer!
26mReal Time analytics - Sense analyze generate insights with Fabric
21mBreaking out of the habit of bulk loading everything
21mSimplify Your Data Stack: Automate Orchestrate and Integrate Data
53mScale your business in real-time using ML in Microsoft Fabric Real-time Analytics
28mTick Tock: What the heck is time-series data?
38mDeep Dive Fluent Bit: Logging & Stream Processing
46mData Exploration & Experimentation with Notebooks in Azure