Introduction to Kusto Query Language (KQL) in Azure Log Analytics

Kusto Query Language (KQL) is the primary query language used across Azure Monitor, Microsoft Sentinel, Azure Data Explorer, and Microsoft Defender. In this lab, you will learn KQL fundamentals by querying real log data inside an Azure Log Analytics workspace. Starting with basic operators like search, where, and project, you will progress to aggregating data with summarize and visualizing results with render — all within the Azure Portal's Logs query editor.

Objectives

Upon completion of this beginner level lab, you will be able to:

• Navigate to a Log Analytics workspace and use the Logs query editor
• Write basic KQL queries using search, where, project, and take operators
• Filter, sort, and format query results using extend, sort by, and top
• Aggregate data using summarize with count(), avg(), and bin()
• Create time-based queries using ago() and render visual charts

Who is this lab for?

This lab is designed for:

• Cloud engineers getting started with Azure monitoring
• Security analysts learning log analysis fundamentals
• DevOps engineers who need to query Azure Monitor logs
• IT administrators managing Azure environments