Write your first query with Kusto Query Language – Training | Microsoft Learn

Function app logs

Get to know the data

The take operator is perfect for this task, because it returns a specific number of arbitrary rows.

// comments
FunctionAppLogs 
| take 5

You’ll use the¬†project¬†operator to define which columns you want to see in the output and also to define new columns on the fly on the tabular.

// comments
FunctionAppLogs 
| project TimeGenerated, HostInstanceId, Message
| take 5

The where operator filters results that satisfy a certain condition.

// comments
FunctionAppLogs 
| project TimeGenerated, HostInstanceId, Message
| where Message == "ADANOK:"
| take 2