kql | Query Language API combines the flexibility of Kirby | Content Management System library

I just installed an ELK stack (1 t3.medium with ES & Logstash, 1 t2.micro with Kibana).
So I can finally have a look at my logs and above all, do some learning around this stack !

I have a lot of logs like this one :
run-docker-runtime\x2drunc-moby-49fe22a2acfc527a65a195a0797694d933f00ce5771e927b8d99f6efaab1f161-runc.IfVJYS.mount: Succeeded.

I found a workaround here but before removing all the logs, I wanted to do some filtering inside Kibana to not see them.

I tried to do the following:

• KQL: message: docker and not message: "*mount*Succeeded*"
• KQL: not message: "*mount: Succeeded."
• Lucene: NOT message: "*mount: Succeeded."

Any of theses queries removed the kind of message above.

What do I do wrong ? :)

Thanks all

I want to create an optional dropdown parameter in an Azure Workbook. Creating a dropdown parameter with this guide is straight forward

Then the parameter can be referenced in KQL as shown in the example with

I have a table which I would like to get the latest entry for each group using Kusto Query Language. Here's the table:

DocumentStatusLogs

The table would be grouped by DocumentID and sorted by DateCreated in descending order. For each DocumentID, I want to get the latest status.

My preferred output:

Is there any way to get only the top from each group using KQL?

The pseudo-code GetOnlyTheTop is as follows:

In application insights I can click on an exception and find nicely formatted information about it if I click on it.
This could look like this:

I would like to archive the same in an Azure Workbook. Here I can display all my exceptions with the KQL Term "Exceptions".
With the column settings I was hoping to be able to create a link to the Application insights page that shows me the same result like in the picture above.
I use this configuration:

Now I have a link, but when I click it there is just an empty pane:

Is there anything I misunderstand?
How do I need to configure my column settings to get a direct link to the Exception details like in clicking on the same item in Application Insights?

I am trying to get last login details of user in Kusto database using KQL query language. However I am not getting exact result with below query.

GlobalID - Unique GUID Value which will be created every time user logged in

UserId - Logged in UserId value

LastSuccessFullLoginTimeStamp - Max Timestamp value

I am using kqlmagic to execute KQL queries in my Jupyter notebook. While executing, kqlmagic prints output to the notebook such as:

I am trying to create a requests per minute time (RPM) chart in Azure Monitor workbook for requests which are throttled and non-throttle in the form of two lines (overlayed). I manage to create a time chart for RPM with one line but what is the best way to show two distinct lines for each type of request.

Here is the KQL for the chart. Thinking to perform self-join on the table (T) based on ResultType (Throttled and Non-Throttled) but not sure about it. Maybe a better solution out there.

This seems like it should be easy, but I can't seem to find the data in my Log Analytics Workspace (LAW) to be able to write a KQL query to get CPU Percentage for an App Service Plan. I realize there is already a chart in the portal with this information,

but I want to do this using KQL because I am combining several pieces of data together to put on an Azure dashboard.

Googling gives me something like this:

Can you please tell me how to extract values of category, enabled and categoryGroup from the below JSON column in KQL(Azure Data Explorer).

Below JSON value is exactly what I see in the column called "Logs". I see that the Column Logs is defined as string datatype in table