You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: data-explorer/includes/cross-repo/fluent-bit-2.md
+67-27Lines changed: 67 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -74,18 +74,32 @@ To configure Fluent Bit to send logs to your table in Kusto, create a [classic m
74
74
| tenant_id | The tenant ID from [Create a Microsoft Entra service principal](#create-a-microsoft-entra-service-principal). |:heavy_check_mark:||
75
75
| client_id | The application ID from [Create a Microsoft Entra service principal](#create-a-microsoft-entra-service-principal). |:heavy_check_mark:||
76
76
| client_secret | The client secret key value (password) from [Create a Microsoft Entra service principal](#create-a-microsoft-entra-service-principal). |:heavy_check_mark:||
77
+
| managed_identity_client_id | The client ID of the managed identity to use for authentication. |:heavy_check_mark:||
77
78
| ingestion_endpoint | Enter the value as described for [Ingestion_Endpoint](#ingestion-uri). |:heavy_check_mark:||
78
79
| database_name | The name of the database that contains your logs table. |:heavy_check_mark:||
79
80
| table_name | The name of the table from [Create a target table](#create-a-target-table). |:heavy_check_mark:||
80
81
| ingestion_mapping_reference | The name of the ingestion mapping from [Create a target table](#create-a-target-table). If you didn't create an ingestion mapping, remove the property from the configuration file. |||
81
82
| log_key | Key name of the log content. For instance, `log`. ||`log`|
83
+
| include_tag_key | If enabled, a tag is appended to output.||`On`|
82
84
| tag_key | The key name of tag. Ignored if `include_tag_key` is false. ||`tag`|
83
-
| include_time_key | A timestamp is appended to output, if enabled. Uses the `time_key` property. ||`true`|
85
+
| include_time_key | A timestamp is appended to output, if enabled. Uses the `time_key` property. ||`On`|
84
86
| time_key | The key name for the timestamp in the log records. Ignored if `include_time_key` false. ||`timestamp`|
85
-
| ingestion_endpoint_connect_timeout | The connection timeout of various Kusto endpoints in seconds. ||`60s`|
87
+
| ingestion_endpoint_connect_timeout | The connection timeout of various Kusto endpoints in seconds. ||`60`|
86
88
| compression_enabled | Sends compressed HTTP payload (gzip) to Kusto, if enabled. ||`true`|
87
-
| ingestion_resources_refresh_interval | The ingestion resources refresh interval of Kusto endpoint in seconds. ||`3600`|
89
+
| ingestion_resources_refresh_interval | The ingestion resources refresh interval of Kusto endpoint in seconds. |||
88
90
| workers | The number of [workers](https://docs.fluentbit.io/manual/administration/multithreading#outputs) to perform flush operations for this output. ||`0`|
91
+
| buffering_enabled | If enabled, buffers data into disk before ingesting into Kusto. ||`Off`|
92
+
| buffer_path | Specifies the location of the directory where the buffered data will be stored if `buffering_enabled` is `On`. ||`/tmp/fluent-bit/azure-kusto/`|
93
+
| upload_timeout | Specifies the timeout for uploads if `buffering_enabled` is `On`. Files older than this are ingested even if below size limit. ||`30m`|
94
+
| upload_file_size | Specifies the maximum size of a file to be uploaded if `buffering_enabled` is `On`. ||`200MB`|
95
+
| azure_kusto_buffer_key | Azure Kusto buffer key to identify plugin instances when `buffering_enabled` is `On`. Required for multiple Azure Kusto outputs with buffering. ||`key`|
96
+
| store_dir_limit_size | The maximum size of the directory where buffered data is stored if `buffering_enabled` is `On`. ||`8GB`|
97
+
| buffer_file_delete_early| When `buffering_enabled` is `On`, whether to delete the buffered file early after successful blob creation. ||`Off`|
98
+
| unify_tag | Creates a single buffer file when `buffering_enabled` is `On`. ||`On`|
99
+
| blob_uri_length | Set the length of generated blob URI before ingesting to Kusto. ||`64`|
100
+
| scheduler_max_retries | When `buffering_enabled` is `On`, set the maximum number of retries for ingestion using the scheduler. ||`3`|
101
+
| delete_on_max_upload_error | When `buffering_enabled` is `On`, whether to delete the buffer file on maximum upload errors. ||`Off`|
102
+
| IO_timeout | Configure the HTTP IO timeout for uploads. ||`60s`|
89
103
90
104
To see an example configuration file, select the relevant tab:
91
105
@@ -110,18 +124,31 @@ To see an example configuration file, select the relevant tab:
Copy file name to clipboardExpand all lines: data-explorer/kusto/query/arg-max-aggregation-function.md
+5-14Lines changed: 5 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,6 +37,8 @@ Returns a row in the table that maximizes the specified expression *ExprToMaximi
37
37
38
38
## Examples
39
39
40
+
### General examples
41
+
40
42
The following example finds the maximum latitude of a storm event in each state.
41
43
42
44
:::moniker range="azure-data-explorer"
@@ -67,7 +69,6 @@ The results table displays only the first 10 rows.
67
69
| TEXAS | 36.4607 | DARROUZETT |
68
70
| ... | ... | ... |
69
71
70
-
71
72
The following example finds the last time an event with a direct death happened in each state, showing all the columns.
72
73
73
74
The query first filters the events to include only those events where there was at least one direct death. Then the query returns the entire row with the most recent `StartTime`.
@@ -101,7 +102,6 @@ The results table displays only the first 10 rows and first three columns.
101
102
| LAKE MICHIGAN | 2007-06-07T13:00:00Z | 2007-06-07T13:00:00Z | ... |
The arg_max() function differs from the [max() function](max-aggregation-function.md). The arg_max() function allows you to return other columns along with the maximum value, and [max()](max-aggregation-function.md) only returns the maximum value itself.
135
135
136
-
### Examples
137
-
138
-
#### arg_max()
139
-
140
-
The following example finds the last time an event with a direct death happened, showing all the columns in the table.
141
-
136
+
The following example uses arg_max() to find the last time an event with a direct death happened in each state, showing all the columns.
142
137
The query first filters the events to only include events where there was at least one direct death. Then the query returns the entire row with the most recent (maximum) StartTime.
143
138
144
139
:::moniker range="azure-data-explorer"
@@ -158,11 +153,7 @@ The results table returns all the columns for the row containing the highest val
Find the last time an event with a direct death happened.
164
-
165
-
The query filters events to only include events where there is at least one direct death, and then returns the maximum value for StartTime.
156
+
The following example uses the max() function to find the last time an event with a direct death happened in each state, but only returns the maximum value of StartTime.
Copy file name to clipboardExpand all lines: data-explorer/kusto/query/arg-min-aggregation-function.md
+3-11Lines changed: 3 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ Returns a row in the table that minimizes *ExprToMinimize*, and the values of co
41
41
42
42
## Examples
43
43
44
-
Find the minimum latitude of a storm event in each state.
44
+
The following example finds the maximum latitude of a storm event in each state.
45
45
46
46
:::moniker range="azure-data-explorer"
47
47
> [!div class="nextstepaction"]
@@ -137,11 +137,7 @@ The arg_min() function differs from the [min() function](min-aggregation-functio
137
137
138
138
### Examples
139
139
140
-
#### arg_min()
141
-
142
-
Find the first time an event with a direct death happened, showing all the columns in the table.
143
-
144
-
The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the lowest value for StartTime.
140
+
The following example uses arg_min() to find the last time an event with a direct death happened in each state, showing all the columns.
145
141
146
142
:::moniker range="azure-data-explorer"
147
143
> [!div class="nextstepaction"]
@@ -160,11 +156,7 @@ The results table returns all the columns for the row containing the lowest valu
Find the first time an event with a direct death happened.
166
-
167
-
The query filters events to only include those where there is at least one direct death, and then returns the minimum value for StartTime.
159
+
The following example uses the min() function to find the last time an event with a direct death happened in each state, but only returns the minimum value of StartTime.
Copy file name to clipboardExpand all lines: data-explorer/kusto/query/array-iff-function.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,6 +40,8 @@ Returns a dynamic array of the values taken either from the *when_true* or *when
40
40
41
41
## Examples
42
42
43
+
The following example shows how to use the `array_iff()` function to evaluate elements in an array.
44
+
43
45
:::moniker range="azure-data-explorer"
44
46
> [!div class="nextstepaction"]
45
47
> <ahref="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAysoyswrUUjOz0vJLMnMz7NNqcxLzM1M1oguKSpN1UlLzClO1QExYzV1FHIQsoY6RjrGILEihJiJjqmOWaymAi9XjUJqRUlqXopCUWqxbWJRUWJlfGZmmgbcFqBRQJ2aACda2uZ8AAAA"target="_blank">Run the query</a>
Copy file name to clipboardExpand all lines: data-explorer/kusto/query/beta-inv-function.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,6 +42,8 @@ The inverse of the beta cumulative probability density function [beta_cdf()](bet
42
42
43
43
## Examples
44
44
45
+
The following example shows how to use the `beta_inv()` function to return the inverse of the beta cumulative probability density function.
46
+
45
47
:::moniker range="azure-data-explorer"
46
48
> [!div class="nextstepaction"]
47
49
> <ahref="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA11PQQrCMBC85xVDTw3EkAheivYJPXoRkdQEDaRpsIko+HhDWiq4C8sOzOzOaBVz987UodFjyguDcuGuVtSb+APXcRiMj80UH9bfKDkR5BJcMkjBBcO2zOqonNWwPqRYscKRfPfHCWiRdW9rnJ7gk3MLtZybP9YbyQVdJcUZ7IQ9xKrsVFeRM/nAvKLxGj0OxfTF+mcdljhzDvoFBansKu8AAAA="target="_blank">Run the query</a>
Copy file name to clipboardExpand all lines: data-explorer/kusto/query/consume-operator.md
+11-8Lines changed: 11 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,11 +14,8 @@ Consumes the tabular data stream handed to the operator.
14
14
The `consume` operator is mostly used for triggering the query side-effect without actually returning
15
15
the results back to the caller.
16
16
17
-
The `consume` operator can be used for estimating the
18
-
cost of a query without actually delivering the results back to the client.
19
-
(The estimation isn't exact for various reasons; for example, `consume`
20
-
is calculated distributively, so `T | consume` won't transmit the table's
21
-
data between the nodes of the cluster.)
17
+
The `consume` operator can be used for estimating the cost of a query without actually delivering the results back to the client.
18
+
(The estimation isn't exact for various reasons; for example, `consume` is calculated distributively, so `T | consume` won't transmit the table's data between the nodes of the cluster.)
22
19
23
20
## Syntax
24
21
@@ -32,9 +29,13 @@ data between the nodes of the cluster.)
32
29
|--|--|--|--|
33
30
|*DecodeBlocks*|`bool`|| If set to `true`, or if the request property `perftrace` is set to `true`, the `consume` operator won't just enumerate the records at its input, but actually force each value in those records to be decompressed and decoded.|
34
31
35
-
##Example
32
+
### Returns
36
33
37
-
The following example consumes the results of a query without returning any data to the client.
34
+
The `consume` operator returns the same tabular data stream as its input, but it doesn't return the data to the client.
35
+
36
+
## Examples
37
+
38
+
The following example shows how to use the `consume` operator to trigger the query side-effect without actually returning the results back to the caller.
38
39
39
40
:::moniker range="azure-data-explorer"
40
41
> [!div class="nextstepaction"]
@@ -47,5 +48,7 @@ StormEvents
47
48
| consume
48
49
```
49
50
51
+
In this example, the query filters the `StormEvents` table for rows where the `State` is "TEXAS" and then applies the `consume` operator. The data is processed, but no results are returned to the client.
52
+
50
53
**Output**
51
-
No rows to show.
54
+
The results table is empty, as the `consume` operator does not return any data to the client.
Copy file name to clipboardExpand all lines: data-explorer/kusto/query/geo-s2cell-to-central-point-function.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,6 +34,8 @@ The geospatial coordinate values in [GeoJSON Format](https://tools.ietf.org/html
34
34
35
35
## Examples
36
36
37
+
The following example calculates the geospatial coordinates that represent the center of an S2 cell.
38
+
37
39
:::moniker range="azure-data-explorer"
38
40
> [!div class="nextstepaction"]
39
41
> <ahref="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAysoyswrUSjIB5G2Cump+fHFRsmpOTnxJfnxyal5JUWJOfFgWQ0lQyNjE1MzcyVNrhqF1IqS1LwUheT8/KKUzLzEktRioG6wOj0kMYTCnPy89MyS0pRUoDIkBdEGsToKOYkl2KQMYwEypEkCnAAAAA=="target="_blank">Run the query</a>
Calculates the polygon that represents the S2 Cell rectangular area.
12
+
Calculates the polygon that represents the S2 Cell rectangular area.
13
13
14
14
Read more about [S2 Cells](http://s2geometry.io/devguide/s2cell_hierarchy).
15
15
@@ -34,6 +34,8 @@ Polygon in [GeoJSON Format](https://tools.ietf.org/html/rfc7946) and of a [dynam
34
34
35
35
## Examples
36
36
37
+
The following example calculates the polygon that represents the S2 Cell rectangular area.
38
+
37
39
:::moniker range="azure-data-explorer"
38
40
> [!div class="nextstepaction"]
39
41
> <ahref="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAysoyswrUSg2Sk7NyQnIz6lMz89TsFVIT82Ph4jFl+THF0DENZQsLJONTC2VNAF6g4+NNQAAAA=="target="_blank">Run the query</a>
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments