Azure Data Explorer

Query and load data in Azure Data Explorer (Kusto): run read-only KQL queries with typed parameters, ingest rows inline or by streaming, write query results into tables, create and drop tables and stored functions, read schemas and table details, grant database roles, and check for failed ingestion. Works with the free cluster.

Actions

Action	What it does
Add database principal	Give a user, group or app a role on a database.
Clear table data	Delete every row in a table, including rows from streaming ingestion, but keep the table and its columns.
Create or alter function	Save a reusable KQL function, replacing any function of the same name.
Create table	Create a table with the columns given.
Drop function	Delete a stored function.
Drop table	Delete a table.
Enable streaming ingestion	Turn streaming ingestion on (or off) for a table, which 'Stream rows into table' needs.
Get function	One stored function's parameters, body, folder and description.
Get table details	A table's row count, size and policies.
Get table schema	A table's columns and their types.
Ingest inline data	Add rows to a table straight away, sending them inside the request.
List database principals	Which users, groups and apps hold which role on a database.
List databases	The databases the app can see.
List functions	The stored functions in a database, with their parameters and body.
List ingestion failures	Ingestion that failed in the last 14 days, with the table, time, error and whether it is worth retrying.
List tables	The tables in a database, with their folder and description.
Run management command	Run any management command (text starting with '.', such as '.show table Events extents') for anything the other actions do not cover.
Run query	Run a KQL query and return its rows.
Stream rows into table	Send rows through streaming ingestion, which makes them queryable within seconds.
Write query results to table	Run a query and write its rows into a table: appending, replacing, or creating the table.

Add database principal

Give a user, group or app a role on a database. Giving a role someone already holds changes nothing. Needs the app to be a database admin.

Inputs

PrincipalprincipaltextRequired: A user's email, a group's email or object id, or an app's client id. A full name such as 'aaduser=ana@contoso.com' also works.
RoleroletextRequired: The role to give.One of: admins, users, viewers, unrestrictedviewers (Unrestricted viewers), ingestors, monitors.
Principal typeprincipal_typetext: What kind of principal it is.One of: aaduser (User (email)), aadgroup (Group (email or object id)), aadapp (Application (client id)). Default: aaduser.
Tenanttenanttext: The principal's tenant id or domain, when it is not in the cluster's own tenant. Leave empty otherwise.
Notesnotestext: An optional note shown next to the role assignment.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

databasetext
principaltext
principalslist
roletext

Example output

{
  "database": "MyDatabase",
  "principal": "aaduser=ana@contoso.com",
  "principals": [],
  "role": "viewers"
}

Clear table data

Delete every row in a table, including rows from streaming ingestion, but keep the table and its columns.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

clearedtrue/false
databasetext
rowslist
tabletext

Example output

{
  "cleared": true,
  "database": "MyDatabase",
  "rows": [],
  "table": "Events"
}

Create or alter function

Save a reusable KQL function, replacing any function of the same name. Other queries can then call it by name.

Inputs

Function namefunction_nametextRequired: Letters, digits and underscores, starting with a letter.
BodybodytextRequired: The KQL the function runs, such as: Events | where Level == 'Error' | take maxRows
Parametersparameterstext: The function's parameters as name:type, comma-separated, such as 'maxRows:long'. Leave empty for none.
Folderfoldertext: An optional folder to file the function under.
Descriptiondoc_stringtext: An optional description stored with the function.
Skip validationskip_validationtrue/false: Save the function even if it refers to tables that do not exist yet.Default: false.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

bodytext
databasetext
doc_stringtext
foldertext
nametext
parameterstext

Example output

{
  "body": "{ Events | where Level == 'Error' | take maxRows }",
  "database": "MyDatabase",
  "doc_string": "Latest error events",
  "folder": "Lodol",
  "name": "RecentErrors",
  "parameters": "(maxRows:long)"
}

Create table

Create a table with the columns given. If a table of that name already exists with the same columns the step succeeds and changes nothing; with different columns it fails rather than pretend the table was created.

Inputs

Table nametabletextRequired: The new table's name. Names are case-sensitive.
ColumnscolumnslistRequired: Each column's name and type, in order. Text such as 'Timestamp:datetime, Level:string' also works.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).
Folderfoldertext: An optional folder to file the table under.
Descriptiondoc_stringtext: An optional description stored with the table.

Outputs

columnslist: Each column's name and type
csl_schematext: The columns as name:type, comma-separated
databasetext
doc_stringtext
foldertext
schemaobject: The schema document as returned
schema_verifiedtrue/false: Whether the returned columns were checked against the request
tabletext

Example output

{
  "columns": [
    {
      "name": "Timestamp",
      "type": "datetime"
    },
    {
      "name": "Level",
      "type": "string"
    }
  ],
  "csl_schema": "Timestamp:datetime, Level:string",
  "database": "MyDatabase",
  "doc_string": "",
  "folder": "",
  "schema": {
    "Name": "Events",
    "OrderedColumns": [
      {
        "CslType": "datetime",
        "Name": "Timestamp",
        "Type": "System.DateTime"
      },
      {
        "CslType": "string",
        "Name": "Level",
        "Type": "System.String"
      }
    ]
  },
  "schema_verified": true,
  "table": "Events"
}

Drop function

Delete a stored function.

Inputs

Functionfunction_nametextRequired: The stored function. Names are case-sensitive.
Succeed if it is already goneif_existstrue/false: When on, the step succeeds even if there is nothing to drop.Default: true.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

databasetext
droppedtrue/false
function_nametext

Example output

{
  "database": "MyDatabase",
  "dropped": true,
  "function_name": "RecentErrors"
}

Drop table

Delete a table. Its data can no longer be queried, though Azure keeps it recoverable for a while.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).
Succeed if it is already goneif_existstrue/false: When on, the step succeeds even if there is nothing to drop.Default: true.

Outputs

databasetext
droppedtrue/false
remaining_tableslist
tabletext

Example output

{
  "database": "MyDatabase",
  "dropped": true,
  "remaining_tables": [
    "Logs"
  ],
  "table": "Events"
}

Enable streaming ingestion

Turn streaming ingestion on (or off) for a table, which 'Stream rows into table' needs.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Enabledenabledtrue/false: On to allow streaming ingestion, off to stop it.Default: true.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

databasetext
enabledtrue/false
policyobject
rowslist
tabletext

Example output

{
  "database": "MyDatabase",
  "enabled": true,
  "policy": {
    "IsEnabled": true
  },
  "rows": [],
  "table": "Events"
}

Get function

One stored function's parameters, body, folder and description.

Inputs

Functionfunction_nametextRequired: The stored function. Names are case-sensitive.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

bodytext
databasetext
doc_stringtext
foldertext
nametext
parameterstext

Example output

{
  "body": "{ Events | where Level == 'Error' | take maxRows }",
  "database": "MyDatabase",
  "doc_string": "Latest error events",
  "folder": "Lodol",
  "name": "RecentErrors",
  "parameters": "(maxRows:long)"
}

Get table details

A table's row count, size and policies. The figures can be up to 15 minutes old, so to check rows you have just ingested, count them with 'Run query' instead.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

AuthorizedPrincipalslist
CachingPolicyobject
DatabaseNametext
DocStringtext
Foldertext
HotExtentSizenumber
HotExtentsnumber
HotOriginalSizenumber
HotRowCountnumber
IngestionBatchingPolicyobject
MaxExtentsCreationTimetext
MergePolicyobject
MinExtentsCreationTimetext
RetentionPolicyobject
RowOrderPolicytext
ShardingPolicyobject
StreamingIngestionPolicyobject
TableIdtext
TableNametext
TotalExtentSizenumber
TotalExtentsnumber
TotalOriginalSizenumber
TotalRowCountnumber

Example output

{
  "DatabaseName": "MyDatabase",
  "StreamingIngestionPolicy": {
    "IsEnabled": true
  },
  "TableName": "Events",
  "TotalExtentSize": 40960.0,
  "TotalExtents": 3,
  "TotalRowCount": 1200
}

Get table schema

A table's columns and their types.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

columnslist: Each column's name and type
csl_schematext: The columns as name:type, comma-separated
databasetext
doc_stringtext
foldertext
schemaobject: The schema document as returned
tabletext

Example output

{
  "columns": [
    {
      "name": "Timestamp",
      "type": "datetime"
    },
    {
      "name": "Level",
      "type": "string"
    }
  ],
  "csl_schema": "Timestamp:datetime, Level:string",
  "database": "MyDatabase",
  "doc_string": "",
  "folder": "",
  "schema": {
    "Name": "Events",
    "OrderedColumns": [
      {
        "CslType": "datetime",
        "Name": "Timestamp",
        "Type": "System.DateTime"
      },
      {
        "CslType": "string",
        "Name": "Level",
        "Type": "System.String"
      }
    ]
  },
  "table": "Events"
}

Ingest inline data

Add rows to a table straight away, sending them inside the request. Suited to the small batches a workflow produces (up to 1 MB per step) and needs no streaming policy.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Datadatatext: The rows as text in the chosen format, one record per line, with one value per table column in the table's column order. Use this or 'Rows'.
Rowsrowslist: The rows as a list, each either a list of values in column order or an object of column: value. Sent as CSV. Use this or 'Data'.
Formatdata_formattext: The format of 'Data'. Rows given as a list are always CSV.One of: csv, tsv (TSV (tab-separated)), psv (PSV (pipe-separated)), json (JSON (needs a mapping)), multijson (Multi-line JSON (needs a mapping)). Default: csv.
Ingestion mappingmapping_nametext: The name of an ingestion mapping created on the table. Required for JSON formats; leave empty for CSV, TSV and PSV.
Skip header lineignore_first_recordtrue/false: Turn on when the first line of 'Data' is a header.Default: false.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

databasetext
extent_idslist
formattext
rows_sentnumber
tabletext

Example output

{
  "database": "MyDatabase",
  "extent_ids": [
    "4a6d9b1e-6f2c-4b4e-9f52-0d3c9a1b2c3d"
  ],
  "format": "csv",
  "rows_sent": 2,
  "table": "Events"
}

List database principals

Which users, groups and apps hold which role on a database. Needs the app to be a database admin.

Inputs

Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "Role",
      "type": "string"
    }
  ],
  "database": "MyDatabase",
  "row_count": 1,
  "rows": [
    {
      "Notes": "Lodol",
      "PrincipalDisplayName": "Lodol",
      "PrincipalFQN": "aadapp=00000000-0000-0000-0000-000000000000",
      "PrincipalObjectId": "00000000-0000-0000-0000-000000000000",
      "PrincipalType": "AAD Application",
      "Role": "Database MyDatabase Admin"
    }
  ],
  "truncated": false
}

List databases

The databases the app can see. A database only appears once the app has been given a role on it.

Inputs

None.

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
databaseslist: The database names
hinttext: What to do when none are visible
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "DatabaseName",
      "type": "string"
    }
  ],
  "database": null,
  "databases": [
    "MyDatabase"
  ],
  "row_count": 1,
  "rows": [
    {
      "DatabaseName": "MyDatabase",
      "PrettyName": "MyDatabase"
    }
  ],
  "truncated": false
}

List functions

The stored functions in a database, with their parameters and body.

Inputs

Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
functionslist: The function names
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "Name",
      "type": "string"
    }
  ],
  "database": "MyDatabase",
  "functions": [
    "RecentErrors"
  ],
  "row_count": 1,
  "rows": [
    {
      "Name": "RecentErrors",
      "Parameters": "(maxRows:long)"
    }
  ],
  "truncated": false
}

List ingestion failures

Ingestion that failed in the last 14 days, with the table, time, error and whether it is worth retrying.

Inputs

Tabletabletext: Only failures for this table. Leave empty for all.
Maximum rowslimitnumber: Return at most this many failures.From 1 to 10000. Default: 100.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "Table",
      "type": "string"
    }
  ],
  "database": "MyDatabase",
  "row_count": 0,
  "rows": [],
  "truncated": false
}

List tables

The tables in a database, with their folder and description.

Inputs

Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
tableslist: The table names
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "TableName",
      "type": "string"
    }
  ],
  "database": "MyDatabase",
  "row_count": 1,
  "rows": [
    {
      "DatabaseName": "MyDatabase",
      "TableName": "Events"
    }
  ],
  "tables": [
    "Events"
  ],
  "truncated": false
}

Run management command

Run any management command (text starting with '.', such as '.show table Events extents') for anything the other actions do not cover. What it may do is limited by the app's database role.

Inputs

CommandcommandtextRequired: The command, starting with '.'.
Databasedatabasetext: The database to run it in. Leave empty for the connection's default, or for a cluster-level command such as '.show databases'.
Maximum rowslimitnumber: Return at most this many rows.From 1 to 10000. Default: 1000.

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
table_countnumber: How many result tables
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "Timestamp",
      "type": "datetime"
    },
    {
      "name": "Level",
      "type": "string"
    }
  ],
  "database": "MyDatabase",
  "row_count": 1,
  "rows": [
    {
      "Level": "Info",
      "Timestamp": "2026-09-22T10:00:00Z"
    }
  ],
  "table_count": 1,
  "truncated": false
}

Run query

Run a KQL query and return its rows. The query runs read-only, so it cannot change data. Put values in 'Query parameters' and refer to them by name, so a quote in a value cannot change the query.

Inputs

KQL queryquerytextRequired: The query, such as: Events | where Level == lvl | take 10
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).
Query parametersparametersobject: Values the query refers to by name, such as {"lvl": "Error"}. Text, whole numbers, decimals, true/false and JSON values are typed automatically.
Maximum rowslimitnumber: Return at most this many rows.From 1 to 10000. Default: 1000.

Outputs

columnslist: The result's columns, in order
databasetext: The database it ran against
errorslist: Errors reported by the query
has_errorstrue/false: Whether the query reported errors alongside its rows
row_countnumber: How many rows are returned
rowslist: The rows, each keyed by column name
table_countnumber: How many result tables
truncatedtrue/false: Whether more rows existed than were returned

Example output

{
  "columns": [
    {
      "name": "Timestamp",
      "type": "datetime"
    },
    {
      "name": "Level",
      "type": "string"
    }
  ],
  "database": "MyDatabase",
  "errors": [],
  "has_errors": false,
  "row_count": 1,
  "rows": [
    {
      "Level": "Info",
      "Timestamp": "2026-09-22T10:00:00Z"
    }
  ],
  "table_count": 1,
  "truncated": false
}

Stream rows into table

Send rows through streaming ingestion, which makes them queryable within seconds. The table needs streaming ingestion turned on first ('Enable streaming ingestion'); 'Ingest inline data' works without it.

Inputs

TabletabletextRequired: The table. Names are case-sensitive.
Datadatatext: The rows as text in the chosen format, one record per line, with one value per table column in the table's column order. Use this or 'Rows'.
Rowsrowslist: The rows as a list, each either a list of values in column order or an object of column: value. Sent as CSV. Use this or 'Data'.
Formatstream_formattext: The format of 'Data'. Rows given as a list are always CSV.One of: CSV, TSV (TSV (tab-separated)), PSV (PSV (pipe-separated)), JSON (JSON (needs a mapping)), MultiJSON (Multi-line JSON (needs a mapping)). Default: CSV.
Ingestion mappingmapping_nametext: The name of an ingestion mapping created on the table. Required for JSON formats; leave empty for CSV, TSV and PSV.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

acceptedtrue/false
databasetext
detailslist
formattext
rows_sentnumber
tabletext

Example output

{
  "accepted": true,
  "database": "MyDatabase",
  "details": [],
  "format": "CSV",
  "rows_sent": 2,
  "table": "Events"
}

Write query results to table

Run a query and write its rows into a table: appending, replacing, or creating the table. Columns are matched by type and position, not by name, so project them in the table's order.

Inputs

Target tabletabletextRequired: The table to write into.
KQL queryquerytextRequired: The query whose rows are written.
Modemodetext: Whether to append, replace or create.One of: set-or-append (Append, creating the table if needed), append (Append to an existing table), set-or-replace (Replace the table's data, creating it if needed), set (Create a new table (fails if it exists)). Default: set-or-append.
Add new columnsextend_schematrue/false: Add columns the query has and the table lacks, instead of failing.Default: false.
Databasedatabasetext: The database to use. Leave empty for the connection's default database (or the only database the app can see).

Outputs

databasetext
extentslist
modetext
rows_ingestednumber
tabletext

Example output

{
  "database": "MyDatabase",
  "extents": [
    {
      "ExtentId": "4a6d9b1e-6f2c-4b4e-9f52-0d3c9a1b2c3d"
    }
  ],
  "mode": "set-or-append",
  "rows_ingested": 2,
  "table": "Events"
}

ActionsCopy Anchor Link

Add database principalCopy Anchor Link

Inputs

Outputs

Clear table dataCopy Anchor Link

Inputs

Outputs

Create or alter functionCopy Anchor Link

Inputs

Outputs

Create tableCopy Anchor Link

Inputs

Outputs

Drop functionCopy Anchor Link

Inputs

Outputs

Drop tableCopy Anchor Link

Inputs

Outputs

Enable streaming ingestionCopy Anchor Link

Inputs

Outputs

Get functionCopy Anchor Link

Inputs

Outputs

Get table detailsCopy Anchor Link

Inputs

Outputs

Get table schemaCopy Anchor Link

Inputs

Outputs

Ingest inline dataCopy Anchor Link

Inputs

Outputs

List database principalsCopy Anchor Link

Inputs

Outputs

List databasesCopy Anchor Link

Inputs

Outputs

List functionsCopy Anchor Link

Inputs

Outputs

List ingestion failuresCopy Anchor Link

Inputs

Outputs

List tablesCopy Anchor Link

Inputs

Outputs

Run management commandCopy Anchor Link

Inputs

Outputs

Run queryCopy Anchor Link

Inputs

Outputs

Stream rows into tableCopy Anchor Link

Inputs

Outputs

Write query results to tableCopy Anchor Link

Inputs

Outputs

On this page

Actions

Add database principal

Clear table data

Create or alter function

Create table

Drop function

Drop table

Enable streaming ingestion

Get function

Get table details

Get table schema

Ingest inline data

List database principals

List databases

List functions

List ingestion failures

List tables

Run management command

Run query

Stream rows into table

Write query results to table