Kusto Query Language (KQL) turns the mountain of telemetry in Azure Log Analytics into something you can investigate. It helps filter, correlate, and summarize logs from virtual machines, applications, and operating systems—rather like giving a detective a very fast flashlight. section 3.6.2 section 3.8
A practical KQL workflow looks like this:
- Send useful diagnostics—performance counters, event logs, heartbeat signals, and custom application logs—to a Log Analytics workspace. section 3.6.2 section 3.7.1
- Filter records by time or condition, then project the fields that answer the question. section 3.6.2 section 3.7.1
- Summarize and correlate results across sources, such as heartbeat data, system events, syslog, and Azure Activity Log entries. section 3.6.2 section 3.7.1
- Turn useful queries into dashboards, workbooks, alerts, or automated actions instead of repeatedly searching by hand. section 3.6.2 section 3.7.1
Finding recently active virtual machines
Run `Heartbeat | where TimeGenerated > ago(1h) | summarize count() by Computer` to count heartbeat records for each VM during the past hour. To investigate an unexpected restart, compare the last heartbeat with Windows event logs, Linux syslog entries, and Azure activity around the same timestamp. section 3.6.2 section 3.7.1
Heartbeat | where TimeGenerated > ago(1h) | summarize count() by Computer
Inspect the compact heartbeat query and see how a table, time filter, and summary combine into a useful VM check. section 3.6.2
