azure-kusto

Azure Data Explorer stores mountains of log and sensor readings; this puts the question to it — how many, how often, what changed over the past day — and brings the answer back as a table or a chart.

WHEN TO USE

SCOPE

USE FOR

Run a query against a Kusto database to pull recent events.
Aggregate telemetry by event type or time bucket for a report.
Build a time-series chart to spot performance trends or anomalies.
Join two tables in Kusto to correlate errors with related log entries.
Discover a table's schema before writing a query against it.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (13)

Azure Data Explorer (Kusto) Query & Analytics

Execute KQL queries and manage Azure Data Explorer resources for fast, scalable big data analytics on log, telemetry, and time series data.

Skill Activation Triggers

Use this skill immediately when the user asks to:

"Query my Kusto database for [data pattern]"
"Show me events in the last hour from Azure Data Explorer"
"Analyze logs in my ADX cluster"
"Run a KQL query on [database]"
"What tables are in my Kusto database?"
"Show me the schema for [table]"
"List my Azure Data Explorer clusters"
"Aggregate telemetry data by [dimension]"
"Create a time series chart from my logs"

Key Indicators:

Mentions "Kusto", "Azure Data Explorer", "ADX", or "KQL"
Log analytics or telemetry analysis requests
Time series data exploration
IoT data analysis queries
SIEM or security analytics tasks
Requests for data aggregation on large datasets
Performance monitoring or APM queries

Overview

This skill enables querying and managing Azure Data Explorer (Kusto), a fast and highly scalable data exploration service optimized for log and telemetry data. Azure Data Explorer provides sub-second query performance on billions of records using the Kusto Query Language (KQL).

Key capabilities:

Query Execution: Run KQL queries against massive datasets
Schema Exploration: Discover tables, columns, and data types
Resource Management: List clusters and databases
Analytics: Aggregations, time series, anomaly detection, machine learning

Core Workflow

Discover Resources: List available clusters and databases in subscription
Explore Schema: Retrieve table structures to understand data model
Query Data: Execute KQL queries for analysis, filtering, aggregation
Analyze Results: Process query output for insights and reporting

Query Patterns

Pattern 1: Basic Data Retrieval

Fetch recent records from a table with simple filtering.

Example KQL:

Events
| where Timestamp > ago(1h)
| take 100

Use for: Quick data inspection, recent event retrieval

Pattern 2: Aggregation Analysis

Summarize data by dimensions for insights and reporting.

Example KQL:

Events
| summarize count() by EventType, bin(Timestamp, 1h)
| order by count_ desc

Use for: Event counting, distribution analysis, top-N queries

Pattern 3: Time Series Analytics

Analyze data over time windows for trends and patterns.

Example KQL:

Telemetry
| where Timestamp > ago(24h)
| summarize avg(ResponseTime), percentiles(ResponseTime, 50, 95, 99) by bin(Timestamp, 5m)
| render timechart

Use for: Performance monitoring, trend analysis, anomaly detection

Pattern 4: Join and Correlation

Combine multiple tables for cross-dataset analysis.

Example KQL:

Events
| where EventType == "Error"
| join kind=inner (
    Logs
    | where Severity == "Critical"
) on CorrelationId
| project Timestamp, EventType, LogMessage, Severity

Use for: Root cause analysis, correlated event tracking

Pattern 5: Schema Discovery

Explore table structure before querying.

Tools: kusto_table_schema_get

Use for: Understanding data model, query planning

Key Data Fields

When executing queries, common field patterns:

Timestamp: Time of event (datetime) - use ago(), between(), bin() for time filtering
EventType/Category: Classification field for grouping
CorrelationId/SessionId: For tracing related events
Severity/Level: For filtering by importance
Dimensions: Custom properties for grouping and filtering

Result Format

Query results include:

Columns: Field names and data types
Rows: Data records matching query
Statistics: Row count, execution time, resource utilization
Visualization: Chart rendering hints (timechart, barchart, etc.)

KQL Best Practices

🟢 Performance Optimized:

Filter early: Use where before joins and aggregations
Limit result size: Use take or limit to reduce data transfer
Time filters: Always filter by time range for time series data
Indexed columns: Filter on indexed columns first

🔵 Query Patterns:

Use summarize for aggregations instead of count() alone
Use bin() for time bucketing in time series
Use project to select only needed columns
Use extend to add calculated fields

🟡 Common Functions:

ago(timespan): Relative time (ago(1h), ago(7d))
between(start .. end): Range filtering
startswith(), contains(), matches regex: String filtering
parse, extract: Extract values from strings
percentiles(), avg(), sum(), max(), min(): Aggregations

Best Practices

Always include time range filters to optimize query performance
Use take or limit for exploratory queries to avoid large result sets
Leverage summarize for aggregations instead of client-side processing
Store frequently-used queries as functions in the database
Use materialized views for repeated aggregations
Monitor query performance and resource consumption
Apply data retention policies to manage storage costs
Use streaming ingestion for real-time analytics (< 1 second latency)
Integrate with Azure Monitor for operational insights

MCP Tools Used

Tool	Purpose
`kusto_cluster_list`	List all Azure Data Explorer clusters in a subscription
`kusto_database_list`	List all databases in a specific Kusto cluster
`kusto_query`	Execute KQL queries against a Kusto database
`kusto_table_schema_get`	Retrieve schema information for a specific table

Required Parameters:

subscription: Azure subscription ID or display name
cluster: Kusto cluster name (e.g., "mycluster")
database: Database name
query: KQL query string (for query operations)
table: Table name (for schema operations)

Optional Parameters:

resource-group: Resource group name (for listing operations)
tenant: Azure AD tenant ID

Fallback Strategy: Azure CLI Commands

If Azure MCP Kusto tools fail, timeout, or are unavailable, use Azure CLI commands as fallback.

CLI Command Reference

Operation	Azure CLI Command
List clusters	`az kusto cluster list --resource-group <rg-name>`
List databases	`az kusto database list --cluster-name <cluster> --resource-group <rg-name>`
Show cluster	`az kusto cluster show --name <cluster> --resource-group <rg-name>`
Show database	`az kusto database show --cluster-name <cluster> --database-name <db> --resource-group <rg-name>`

KQL Query via Azure CLI

For queries, use the Kusto REST API or direct cluster URL:

az rest --method post \
  --url "https://<cluster>.<region>.kusto.windows.net/v1/rest/query" \
  --body "{ \"db\": \"<database>\", \"csl\": \"<kql-query>\" }"

When to Fallback

Switch to Azure CLI when:

MCP tool returns timeout error (queries > 60 seconds)
MCP tool returns "service unavailable" or connection errors
Authentication failures with MCP tools
Empty response when database is known to have data

Common Issues

Access Denied: Verify database permissions (Viewer role minimum for queries)
Query Timeout: Optimize query with time filters, reduce result set, or increase timeout
Syntax Error: Validate KQL syntax - common issues: missing pipes, incorrect operators
Empty Results: Check time range filters (may be too restrictive), verify table name
Cluster Not Found: Check cluster name format (exclude ".kusto.windows.net" suffix)
High CPU Usage: Query too broad - add filters, reduce time range, limit aggregations
Ingestion Lag: Streaming data may have 1-30 second delay depending on ingestion method

Use Cases

Log Analytics: Application logs, system logs, audit logs
IoT Analytics: Sensor data, device telemetry, real-time monitoring
Security Analytics: SIEM data, threat detection, security event correlation
APM: Application performance metrics, user behavior, error tracking
Business Intelligence: Clickstream analysis, user analytics, operational KPIs

This skill ships inside the Azure Skills Plugin. Listed package contents include hooks and an MCP server. Installed components and skill versions may vary by AI tool.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add microsoft/azure-skills --skill "azure-kusto" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

What's inside

Files included with this skill.

View on GitHub

Same repository

airunway-aks-setup
Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: "setup AI Runway", "onboard AKS cluster", "install AI Runway", "airunway setup", "deploy model to AKS", "GPU inference on AKS", "KAITO setup on AKS", "run LLM on AKS", "vLLM on AKS", "set up model serving on AKS", "AI Runway controller".Read full description
appinsights-instrumentation
Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.Read full description
azure-ai
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.Read full description
azure-aigateway
Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway.Read full description
azure-app-onboard
End-to-end orchestrator: from a business idea, app idea, or existing app to running Azure deployment with cost estimates and pre-deploy approval. Analyzes your app, auto-detects the right Azure services, scaffolds infrastructure code, and deploys — tailored to your app, not a template. Handles moving existing apps to Azure without rewriting or with minimal changes. WHEN: bring your app to Azure, plan my app, cost to run, is my code ready to deploy, deploy my app to the cloud, deploy all my services, what Azure services do I need, plan my Azure deployment, deploy my new app to Azure, one-click deploy, I have an app and want it on Azure, migrate my app to Azure, help me get started, build an app, no code yet, starter project. DO NOT USE FOR: use azd for deployment(use azure-deploy), optimizing existing costs (use cost-optimization), code readiness checks only (use azure-app-onboard-prereq).Read full description
azure-app-onboard-prereq
Assess whether source code is ready to deploy to Azure — the check BEFORE infrastructure work. Evaluates build health, app completeness, dependencies and local services, stack compatibility, and deployment feasibility. Answers questions about what your app needs before it can be deployed — frameworks, dependencies, and configuration. Checks whether dependencies are compatible and identifies deployment blockers and unsupported frameworks. WHEN: \"evaluate my repo\", \"is my app ready to deploy\", \"what does my app need to deploy\", \"what do I need before deploying\", \"does my app need\", \"can I ship this to Azure\", \"scan my repo for issues\", \"is this app deployable\", \"check if my app is ready for Azure\", \"do I need a Dockerfile\", \"what's blocking my deployment\", \"are there any blockers\", \"are my dependencies compatible\", \"does Azure support my framework\", \"what needs to change before deploying\", \"check my app configuration\".Read full description

Azure Data Explorer (Kusto) Query & Analytics

Skill Activation Triggers

Overview

Core Workflow

Query Patterns

Pattern 1: Basic Data Retrieval

Pattern 2: Aggregation Analysis

Pattern 3: Time Series Analytics

Pattern 4: Join and Correlation

Pattern 5: Schema Discovery

Key Data Fields

Result Format

KQL Best Practices

Best Practices

MCP Tools Used

Fallback Strategy: Azure CLI Commands

CLI Command Reference

KQL Query via Azure CLI

When to Fallback

Common Issues

Use Cases

Account or credentials required

What's inside

More skills

MCP keyword matches