Fabric RTI 101: Advanced KQL Operators

When you start working with real telemetry data, you’ll quickly notice that not everything fits neatly into tables and columns. Much of it is semi-structured — think JSON payloads, arrays, and nested fields.

KQL provides a set of advanced operators that make handling this kind of data easy and powerful.

Operator	Purpose / Description
parse, parse_json	Extract fields from strings, logs, or JSON content
mv-expand	Expand or flatten arrays into individual rows
top-nested	Find top results within grouped categories
union	Combine results from multiple tables or streams
(Advanced tools)	Ideal for semi-structured or nested data

The parse and parse_json operators let you extract values directly from text or JSON fields. For example, if your logs contain a JSON blob, you can pull out fields like deviceId or errorCode as first-class columns you can filter and aggregate on.

The mv-expand operator is used when a single row contains an array — for instance, a list of sensors or metrics. It flattens those arrays so each item becomes its own row, making them easier to analyze individually.

top-nested is another powerful tool. It lets you find the top results within each group — for example, the top three error codes per device or the highest CPU usage per server.

Finally, union combines multiple tables or streams into one dataset, which is handy when you’re pulling data from several sources or environments.

Together, these operators are what make KQL so flexible. They let you work with messy, nested, real-world telemetry data — not just perfect rows and columns — and still query it efficiently at scale.

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-06-20