where 运算符where operator

筛选表,获取满足谓词的行子集。Filters a table to the subset of rows that satisfy a predicate.

T | where fruit=="apple"

Alias filterAlias filter


T | where PredicateT | where Predicate


  • T :其记录待筛选的表格输入。T : The tabular input whose records are to be filtered.
  • 谓词 :针对 T 的列的 boolean 表达式。对 T 中的每一行执行此计算。Predicate : A boolean expression over the columns of T. It's evaluated for each row in T.


对于 T 中的行, PredicatetrueRows in T for which Predicate is true.

注释 Null 值:与 null 值进行比较时,所有筛选函数都返回 false。Notes Null values: all filtering functions return false when compared with null values. 可以使用特殊的 null 感知函数编写处理 null 值的查询。You can use special null-aware functions to write queries that handle null values.

isnull()isnotnull()isempty()isnotempty()isnull(), isnotnull(), isempty(), isnotempty().


获取最快性能:To get the fastest performance:

  • 在列名称和常量之间 采用简单比较Use simple comparisons between column names and constants. (“常量”指基于表的常量 - now()ago() 均可用,使用 let 语句分配的标量值也可用。)('Constant' means constant over the table - so now() and ago() are OK, and so are scalar values assigned using a let statement.)

    例如,使用 where Timestamp >= ago(1d) 而非 where floor(Timestamp, 1d) == ago(1d)For example, prefer where Timestamp >= ago(1d) to where floor(Timestamp, 1d) == ago(1d).

  • 简单项优先 :如果有多个子句与 and 联合,则将仅涉及一列的子句放在首位。Simplest terms first : If you have multiple clauses conjoined with and, put first the clauses that involve just one column. 因此 Timestamp > ago(1d) and OpId == EventId 优于其他方法。So Timestamp > ago(1d) and OpId == EventId is better than the other way around.

有关详细信息,请参阅可用字符串运算符的摘要和可用数值运算符的摘要。For more information, see the summary of available String operators and the summary of available Numerical operators.

示例:先进行简单比较Example: Simple comparisons first

| where Timestamp > ago(1h)
    and Source == "MyCluster"
    and ActivityId == SubActivityId 

此示例检索那些时间不超过 1 小时、来自“MyCluster”源且包含的两个列的值相同的记录。This example retrieves records that are no older than 1 hour, come from a source called MyCluster, and have two columns of the same value.

请注意,我们将两个列之间的比较放在最后,因为它不能使用索引,因此会强制执行扫描。Notice that we put the comparison between two columns last, as it can't use the index and forces a scan.

示例:列表包含字符串Example: Columns contain string

Traces | where * has "Kusto"

任何列中出现单词“Kusto”的所有行。All the rows in which the word "Kusto" appears in any column.