Fabric RTI 101: What is KQL?

KQL, or Kusto Query Language, is a read-only, declarative query language.

Unlike SQL, which is procedural and typically runs in relational systems, KQL is pipeline-based. Each operation feeds directly into the next using the pipe (|) operator. This makes it incredibly intuitive once you get used to it — you start with a dataset, apply filters, transformations, and aggregations step by step, building your query like a flow of operations.

For example, you might start with a table of events, then filter for errors, group them by region, and calculate counts — all in a single, readable flow.

It was originally created for Azure Data Explorer — the system Microsoft designed to handle massive telemetry workloads.

It’s built specifically for large-scale data exploration, particularly for logs, telemetry, and time-series data. Instead of focusing on transactions or updates, KQL is all about quickly slicing, filtering, and analyzing high-volume data. You can think of it as a language designed for insights, not for modifying data.

You’ll find KQL everywhere across Microsoft’s ecosystem: Fabric Real-Time Intelligence, Azure Monitor, Log Analytics, Microsoft Sentinel and Azure Data Explorer (or ADX) all rely on it. So, once you learn it here, you can reuse the same knowledge across a wide range of monitoring and analytics platforms.

While looking into KQL, I recommend you also check out the Kusto Detective Agency. It gamifies learning KQL. You’ll find it at https://detective.kusto.io .

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-06-04