表格表达式语句Tabular expression statements

表格表达式语句是人们在谈论查询时通常会想到的内容。The tabular expression statement is what people usually have in mind when they talk about queries. 此语句通常出现在语句列表的最后,其输入和输出都由表或表格数据集组成。This statement usually appears last in the statement list, and both its input and its output consists of tables or tabular data sets.

Kusto 对表格表达式语句使用数据流模型。Kusto uses a data flow model for the tabular expression statement. 表格表达式语句的典型结构由这些部分构成:表格数据源(如 Kusto 表)、表格数据运算符(如筛选器和投影),可能还包括呈现运算符 。The typical structure of a tabular expression statement is a composition of tabular data sources (such as Kusto tables), tabular data operators (such as filters and projections), and potentially rendering operators. 这种构成由管道字符(|)表示,赋予语句一种非常有规律的形式,直观地表示表格数据从左向右流动。The composition is represented by the pipe character (|), giving the statement a very regular form that visually represents the flow of tabular data from left to right. 每个运算符都“从管道”接受一个表格数据集,从运算符正文接受其他输入(包括其他表格数据集),然后向其后的下一个运算符发出表格数据集,如下所示:Each operator accepts a tabular data set "from the pipe", and additional inputs (including other tabular data sets) from the body of the operator, then emits a tabular data set to the next operator that follows:

source1 | operator1 | operator2 | renderInstructionsource1 | operator1 | operator2 | renderInstruction

在下面的示例中,源是 Logs(对当前数据库中表的引用),第一个运算符是 where(根据某些因记录而异的谓词,从其输入中筛选出记录),第二个运算符是 count(对其输入数据集中的记录数进行计数):In the following example, the source is Logs (a reference to a table in the current database), the first operator is where (which filter out records from its input according to some per-record predicate), and the second operator is count (which counts the number of records in its input data set):

Logs | where Timestamp > ago(1d) | count

在下面这个更复杂的示例中,join 运算符用于合并来自两个输入数据集的记录:一个是 Logs 表的筛选器,另一个是 Events 表的筛选器。In the following more complex example, the join operator is used to combine records from two input data sets: one which is a filter on the Logs table, and another which is a filter on the Events table.

Logs 
| where Timestamp > ago(1d) 
| join 
(
    Events 
    | where continent == 'Europe'
) on RequestId 

表格数据源Tabular data sources

表格数据源生成记录集,以便由表格数据运算符进一步处理 。A tabular data source produces sets of records, to be further processed by tabular data operators. Kusto 支持很多这种源:Kusto supports a number of these sources:

  • 表引用(指上下文数据库或某种其他群集/数据库中的 Kusto 表。)Table references (which refer to a Kusto table, in the context database or some other cluster/database.)
  • 表格 range 运算符The tabular range operator.
  • print 运算符The print operator.
  • 返回表的函数的调用。An invocation of a function that returns a table.
  • 表文本(“datatable”)。A table literal ("datatable").