快速入门:在 Azure 数据资源管理器 Web UI 中查询数据Quickstart: Query data in Azure Data Explorer Web UI

Azure 数据资源管理器是一项快速、完全托管的数据分析服务,用于对大量数据进行实时分析。Azure Data Explorer is a fast, fully managed data analytics service for real-time analysis of large volumes of data. Azure 数据资源管理器提供了一种 Web 体验,使你能够连接到 Azure 数据资源管理器群集并编写、运行和共享 Kusto 查询语言命令和查询。Azure Data Explorer provides a web experience that enables you to connect to your Azure Data Explorer clusters and write, run, and share Kusto Query Language commands and queries. 该 Web 体验可在 Azure 门户中使用,也可作为独立的 Web 应用程序(即 Azure 数据资源管理器 Web UI)使用。The web experience is available in the Azure portal and as a stand-alone web application, the Azure Data Explorer Web UI. Azure 数据资源管理器 Web UI 还可以由 HTML iframe 中的其他 Web 门户托管。The Azure Data Explorer Web UI can also be hosted by other web portals in an HTML iframe. 有关如何托管 Web UI 和所用 Monaco 编辑器的详细信息,请参阅 Monaco IDE 集成For more information on how to host the Web UI and the Monaco editor used, see Monaco IDE integration. 本快速入门将在独立的 Azure 数据资源管理器 Web UI 中进行操作。In this quickstart, you'll be working in the stand-alone Azure Data Explorer Web UI.

Kusto Web 浏览器体验演练

先决条件Prerequisites

  • Azure 订阅。An Azure subscription. 如果没有订阅,请在开始之前创建一个 Azure 帐户If you don’t have one, create a Azure account before you begin.
  • 包含数据的群集和数据库。Cluster and database with data. 创建自己的群集或使用 Azure 数据资源管理器 help 群集。Create your own cluster or use the Azure Data Explorer help cluster.

登录应用程序Sign in to the application

登录到应用程序Sign in to the application.

添加群集Add clusters

首次打开应用程序时,不存在任何群集连接。When you first open the application, there are no cluster connections.

添加群集

开始运行查询前,必须先将连接添加到群集中。You must add a connection to a cluster before you can start running queries. 本部分会将连接添加到 Azure 数据资源管理器 help 群集以及在先决条件中创建的测试群集中(可选)。In this section, you’ll add connections to the Azure Data Explorer help cluster and to the test cluster you've created in the Prerequisites (optional).

添加 help 群集Add help cluster

  1. 在应用程序的左上角,选择“添加群集”。In the upper left of the application, select Add Cluster.

  2. 在“添加群集”对话框中,输入 URI https://help.kusto.chinacloudapi.cn ,然后选择“添加” 。In the Add cluster dialog box, enter the URI https://help.kusto.chinacloudapi.cn, then select Add.

  3. 在左侧窗格中,现在应看到 help 群集。In the left pane, you should now see the help cluster. 展开“示例”数据库并打开“Tables”文件夹,查看有权访问的示例表 。Expand the Samples database and open the Tables folder to see the sample tables that you have access to.

    在 help 群集中查找表

我们在本快速入门后面部分以及其他 Azure 数据资源管理器文章中使用 StormEvents 表。We use the StormEvents table later in this quickstart, and in other Azure Data Explorer articles.

添加群集Add your cluster

现在添加创建的测试群集。Now add the test cluster you created.

  1. 选择“添加群集”。Select Add Cluster.

  2. 在“添加群集”对话框中,以 https://<ClusterName>.<Region>.kusto.chinacloudapi.cn/ 格式输入测试群集 URL,然后选择“添加” 。In the Add Cluster dialog box, enter your test cluster URL in the form https://<ClusterName>.<Region>.kusto.chinacloudapi.cn/, then select Add. 例如,https://mydataexplorercluster.chinaeast2.kusto.chinacloudapi.cn,如下图所示:For example, https://mydataexplorercluster.chinaeast2.kusto.chinacloudapi.cn as in the following image:

    输入测试群集 URL

  3. 在以下示例中,会看到 help 群集和一个新群集 docscluster.chinaeast2(完整 URL 为 https://docscluster.chinaeast2.kusto.chinacloudapi.cn/) 。In the example below, you see the help cluster and a new cluster, docscluster.chinaeast2 (full URL is https://docscluster.chinaeast2.kusto.chinacloudapi.cn/).

    测试群集

运行查询Run queries

你现在可以在两个群集上运行查询(假定测试群集中包含数据)。You can now run queries on both clusters (assuming you have data in your test cluster). 在本文中,我们重点介绍 help 群集。For this article, we'll focus on the help cluster.

  1. 在左窗格中的 help 群集下,选择示例数据库 。In the left pane, under the help cluster, select the Samples database.

  2. 将以下查询复制并粘贴到查询窗口中。Copy and paste the following query into the query window. 在窗口顶部,选择“运行”。At the top of the window, select Run.

    StormEvents
    | sort by StartTime desc
    | take 10
    

    此查询返回 StormEvents 表中的 10 条最新记录。This query returns the 10 newest records in the StormEvents table. 结果应如下表所示。The result should look like the following table.

    表的屏幕截图,其中列出了 10 个风暴事件的数据。

    下图显示了应用程序的状态,其中添加了群集以及带有结果的查询。The following image shows the state of the application, with the cluster added, and a query with results.

    全屏

  3. 将以下查询复制并粘贴到第一个查询下方的查询窗口中。Copy and paste the following query into the query window, below the first query. 请注意,它没有像第一个查询那样在单独行上进行格式化。Notice how it isn't formatted on separate lines like the first query.

    StormEvents | sort by StartTime desc 
    | project StartTime, EndTime, State, EventType, DamageProperty, EpisodeNarrative | take 10
    
  4. 选择新查询。Select the new query. 按 Shift+Alt+F 设置查询格式,如以下查询所示。Press Shift+Alt+F to format the query, so it looks like the following query.

    已格式化查询

  5. 选择“运行”或按 Shift + Enter 以运行查询。Select Run or press Shift+Enter to run a query. 此查询返回与第一条记录相同的记录,但仅包括 project 语句中指定的列。This query returns the same records as the first one, but includes only the columns specified in the project statement. 结果应如下表所示。The result should look like the following table.

    表的屏幕截图,其中列出了 10 个风暴事件的开始时间、结束时间、州、事件类型、损伤特性和事件叙述。

    提示

    选择查询窗口顶部的“撤回”以显示第一个查询的结果集,而无需重新运行该查询。Select Recall at the top of the query window to show the result set from the first query without having to rerun the query. 通常在分析期间,会运行多个查询,通过“撤回”,你可以检索先前查询的结果。Often during analysis, you run multiple queries, and Recall allows you to retrieve the results of previous queries.

  6. 让我们再运行一个查询来查看不同类型的输出。Let's run one more query to see a different type of output.

    StormEvents
    | summarize event_count=count(), mid = avg(BeginLat) by State
    | sort by mid
    | where event_count > 1800
    | project State, event_count
    | render columnchart
    

    结果应如下图所示。The result should look like the following chart.

    柱形图

    备注

    查询表达式中的空白行可能影响执行查询的那一部分。Blank lines in the query expression can affect which part of the query is executed.

    • 如果未选定文本,则假定以空行分隔查询或命令。If no text selected, it's assumed that the query or command is separated by empty lines.
    • 如果选定了文本,则运行选定的文本。If text is selected, the selected text is run.

使用网格型Work with the table grid

现在你已了解基本查询的工作原理,以后可以使用表网格来自定义结果并进行进一步分析。Now that you've seen how basic queries work, you can use the table grid to customize results and do further analysis.

展开单元Expand a cell

展开单元有助于查看长字符串或 JSON 等动态字段。Expanding cells is useful to view long strings or dynamic fields such a JSON.

  1. 双击某个单元格以打开展开的视图。Double-click a cell to open an expanded view. 通过此视图可读取长字符串,并为动态数据提供 JSON 格式设置。This view allows you to read long strings, and provides a JSON formatting for dynamic data.

    Azure 数据资源管理器 WebUI 展开单元以显示长字符串

  2. 单击结果网格右上方的图标以切换阅读窗格模式。Click on the icon on the top right of the result grid to switch reading pane modes. 可为展开的视图选择以下阅读窗格模式:内联、下窗格和右窗格。Choose between the following reading pane modes for expanded view: inline, below pane, and right pane.

    用于更改展开视图读取窗格模式的图标 - Azure 数据资源管理器 WebUI 查询结果

展开行Expand a row

当处理包含多个列的表时,展开整行可以轻松概览不同列及其内容。When working with a table with dozens of columns, expand the entire row to be able to easily see an overview of the different columns and their content.

  1. 单击要展开的行左侧的箭头 >。Click on the arrow > to the left of the row you want to expand.

    展开 Azure 数据资源管理器 WebUI 中的行

  2. 在展开的行中,某些列处于展开状态(向下箭头),某些列处于折叠状态(向右箭头)。Within the expanded row, some columns are expanded (arrow pointing down), and some columns are collapsed (arrow pointing right). 单击这些箭头可以在这两种模式之间切换。Click on these arrows to toggle between these two modes.

按结果归组为列Group column by results

在结果中,可以按任何列对结果进行分组。Within the results, you can group results by any column.

  1. 运行以下查询:Run the following query:

    StormEvents
    | sort by StartTime desc
    | take 10
    
  2. 将鼠标悬停在“州”列上,选择菜单,然后选择“按州分组” 。Mouse-over the State column, select the menu, and select Group by State.

    按州分组

  3. 在网格中,双击“加利福尼亚州”,展开并查看该州的记录。In the grid, double-click on California to expand and see records for that state. 进行探索性分析时,此类型的分组可能会有所帮助。This type of grouping can be helpful when doing exploratory analysis.

    查询结果网格的屏幕截图,其中已展开“加利福尼亚州”组

  4. 将鼠标悬停在“组”列上,然后选择“重置列” 。Mouse-over the Group column, then select Reset columns. 此设置将网格返回到其原始状态。This setting returns the grid to its original state.

    重置列

使用值聚合Use value aggregation

按列分组后,可以使用值聚合函数计算每个组的简单统计信息。After you have grouped by a column, you can then use the value aggregation function to calculate simple statistics per group.

  1. 选择要计算的列的菜单。Select the menu for the column you want to evaluate.

  2. 选择“值聚合”,然后选择要对此列执行的函数类型。Select Value Aggregation, and then select the type of function you want to do on this column.

    按列对结果分组时对结果进行聚合。

筛选列Filter columns

可以使用一个或多个运算符来筛选某个列的结果。You can use one or more operators to filter the results of a column.

  1. 若要筛选特定列,请选择该列的菜单。To filter a specific column, select the menu for that column.

  2. 选择“筛选”图标。Select the filter icon.

  3. 在筛选器生成器中,选择所需的运算符。In the filter builder, select the desired operator.

  4. 键入要用于筛选列的表达式。Type in the expression you wish to filter the column on. 键入时就会对结果进行筛选。Results are filtered as you type.

    备注

    筛选器不区分大小写。The filter isn't case sensitive.

  5. 若要创建多条件筛选器,请选择一个布尔运算符来添加另一个条件To create a multi-condition filter, select a boolean operator to add another condition

  6. 若要删除筛选器,请删除第一个筛选条件中的文本。To remove the filter, delete the text from your first filter condition.

    GIF 显示如何对 Azure 数据资源管理器 WebUI 中的列进行筛选

运行单元格统计信息Run cell statistics

  1. 运行以下查询。Run the following query.

    StormEvents
    | sort by StartTime desc
    | where DamageProperty > 5000
    | project StartTime, State, EventType, DamageProperty, Source
    | take 10
    
  2. 在结果网格中,选择一些数值单元格。In the results grid, select a few of the numerical cells. 使用表网格,你可以选择多个行、列和单元格,并计算它们的聚合。The table grid allows you to select multiple rows, columns, and cells and calculate aggregations on them. Web UI 当前支持以下数值函数:Average、Count、Min、Max 和 Sum 。The Web UI currently supports the following functions for numeric values: Average, Count, Min, Max, and Sum.

    选择函数

从网格向查询添加筛选器Filter to query from grid

筛选网格的另一种简单方法是直接从网格向查询添加筛选器运算符。Another easy way to filter the grid is to add a filter operator to the query directly from the grid.

  1. 选择其中包含要为其创建查询筛选器的内容的单元格。Select a cell with content you wish to create a query filter for.

  2. 右键单击以打开“单元格操作”菜单。Right-click to open the cell actions menu. 选择“将选定内容添加为筛选器”。Select Add selection as filter.

    将 Azure 数据资源管理器 WebUI 中的网格结果选定内容作为筛选器添加到查询中

  3. 将在查询编辑器中向查询添加一个查询子句:A query clause will be added to your query in the query editor:

    通过 Azure 数据资源管理器 WebUI 中的网格筛选添加查询子句

透视Pivot

透视模式功能类似于 Excel 的数据透视表,可用于在网格中执行高级分析。The pivot mode feature is similar to Excel’s pivot table, enabling you to do advanced analysis in the grid itself.

通过透视可以获取列值并将其转换为列。Pivoting allows you to take a columns value and turn them into columns. 例如,可以对“州”进行透视,为“佛罗里达州”、“密苏里州”、“阿拉巴马州”等创建列。For example, you can pivot on State to make columns for Florida, Missouri, Alabama, and so on.

  1. 在网格的右侧,选择“列”以查看表工具面板。On the right side of the grid, select Columns to see the table tool panel.

    表工具面板

  2. 选择“透视模式”,然后按以下方式拖动列:将“EventType”拖动到“行组”;将“DamageProperty”拖动到“值”,并将“State”拖动到“列标签” 。Select Pivot Mode, then drag columns as follows: EventType to Row groups; DamageProperty to Values; and State to Column labels.

    透视模式

    结果应如以下数据透视表所示:The result should look like the following pivot table:

    数据透视表

在结果表中搜索Search in the results table

你可以在结果表中查找特定表达式。You can look for a specific expression within a result table.

  1. 运行以下查询:Run the following query:

    StormEvents
    | where DamageProperty > 5000
    | take 1000
    
  2. 单击右侧的“搜索”按钮,然后键入“Wabash”Click on the Search button on the right and type in "Wabash"

    在表中搜索

  3. 所有提到的搜索表达式现在都在表中突出显示。All mentions of your searched expression are now highlighted in the table. 可以通过单击 Enter 向前移动或按 Shift + Enter 向后移动来在它们之间导航,也可以使用搜索框旁边的向上和向下按钮进行导航 。You can navigate between them by clicking Enter to go forward or Shift+Enter to go backward, or you can use the up and down buttons next to the search box.

    在搜索结果中导航

共享查询Share queries

很多时候,你希望共享创建的查询。Many times, you want to share the queries you create.

  1. 在查询窗口中,选择复制的第一个查询。In the query window, select the first query you copied in.

  2. 在查询窗口顶部,选择“共享”。At the top of the query window, select Share.

    共享菜单

下拉列表中提供了以下选项:The following options are available in the drop-down:

可提供深层链接,以便有权访问群集的其他用户可运行查询。You can provide a deep link so that other users with access to the cluster can run the queries.

  1. 在“共享”中,选择“将查询链接到剪贴板” 。In Share, select Link, query to clipboard.

  2. 将链接和查询复制到文本文件。Copy the link and query to a text file.

  3. 将链接粘贴到新的浏览器窗口中。Paste the link into a new browser window. 结果应如下所示The result should look like the following

    共享查询深层链接

固定到仪表板Pin to dashboard

在 Web UI 中通过查询完成数据探索并找到所需的数据后,可将其固定到仪表板中以便持续监视。When you complete data exploration using queries in the Web UI and find the data you need, you can pin it to a dashboard for continuous monitoring.

若要固定查询:To pin a query:

  1. 在“共享”中,选择“固定到仪表板” 。In Share, select Pin to dashboard.

  2. 在“固定到仪表板”窗格中:In the Pin to dashboard pane:

    1. 提供查询名称。Provide a Query name.
    2. 选择“使用现有查询”或“创建新查询” 。Select Use existing or Create new.
    3. 提供仪表板名称Provide Dashboard name
    4. 选择“创建后查看仪表板”复选框(如果是新仪表板)。Select the View dashboard after creation checkbox (if it's a new dashboard).
    5. 选择“固定”Select Pin

    “固定到仪表板”窗格

备注

“固定到仪表单”选项仅固定所选的查询。Pin to dashboard only pins the selected query. 要创建仪表板数据源并将显示命令转换为仪表板中的视觉对象,必须在数据库列表中选择相关数据库。To create the dashboard data source and translate render commands to a visual in the dashboard, the relevant database must be selected in the database list.

导出查询结果Export query results

要将查询结果导出到 CSV 文件,请选择“文件” > “导出到 CSV” 。To export the query results to a CSV file, select File > Export to CSV.

将结果导出到 CSV 文件

设置Settings

在“设置”选项卡中,你可以:In the Settings tab you can:

选择右上方的设置图标 ,打开“设置”窗口。

“设置”窗口

导出和导入环境设置Export and import environment settings

导出和导入操作有助于保护工作环境,并将其重新定位到其他浏览器和设备。The export and import actions help you protect your work environment and relocate it to other browsers and devices. 导出操作可将所有设置、群集连接和查询选项卡导出到 JSON 文件,该文件可导入到其他浏览器或设备。The export action will export all your settings, cluster connections, and query tabs to a JSON file that can be imported into a different browser or device.

导出环境设置Export environment settings

  1. 在“设置” > “常规”窗口中,选择“导出” 。In the Settings > General window, select Export.
  2. 此操作会将 adx-export.json 文件下载到本地存储中。The adx-export.json file will be downloaded to your local storage.
  3. 选择“清除本地状态”,将环境还原到其原始状态。Select Clear local state to revert your environment to its original state. 此设置将删除所有群集连接并关闭打开的选项卡。This setting deletes all your cluster connections and closes open tabs.

备注

“导出”选项仅导出查询相关数据。Export only exports query related data. 不会在 adx-export.json 文件中导出任何仪表板数据。No dashboard data will be exported within the adx-export.json file.

导入环境设置Import environment settings

  1. 在“设置” > “常规”窗口中,选择“导入” 。In the Settings > General window, select Import. 然后在“警告”弹出窗口中,选择“导入” 。Then in Warning pop-up, select Import.

    导入警告

  2. 从本地存储中找到 adx-export.json 文件,然后将其打开。Locate your adx-export.json file from your local storage and open it.

  3. 以前的群集连接和打开的选项卡现在可用。Your previous cluster connections and open tabs are now available.

备注

“导入”选项将替代任何现有的环境设置和数据。Import overrides any existing environment settings and data.

突出显示错误级别Highlight error levels

Kusto 会尝试解释结果面板中每行的严重性或详细级别,并对其进行相应的着色。Kusto tries to interpret the severity or verbosity level of each row in the results panel and color them accordingly. 它通过将每列的非重复值与一组已知模式(“警告”、“错误”等)进行匹配来实现此目的。It does this by matching the distinct values of each column with a set of known patterns ("Warning", "Error", and so on).

启用错误级别突出显示选项Enable error level highlighting

若要启用错误级别突出显示,请执行以下操作:To enable the error level highlighting:

  1. 选择用户名旁边的“设置”图标。Select the Settings icon next to your user name.

  2. 选择“外观”选项卡,然后将“启用错误级别突出显示”选项切换到右侧。 Select the Appearance tab and toggle the Enable error level highlighting option to the right.

    动画 GIF 显示了如何在设置中启用错误级别突出显示

浅色模式下的错误级别配色方案Error level color scheme in Light mode 深色模式下的错误级别配色方案Error level color scheme in Dark mode
浅色模式下颜色图例的屏幕截图 深色模式下颜色图例的屏幕截图

突出显示的列要求Column requirements for highlighting

对于突出显示的错误级别,列必须是 int、long 或 string 类型。For highlighted error levels, the column must be of type int, long, or string.

  • 如果列的类型为 longintIf the column is of type long or int:
    • 列名必须为“Level”The column name must be Level
    • 值只能包含 1 到 5 之间的数字。Values may only include numbers between 1 and 5.
  • 如果列的类型为 stringIf the column is of type string:
    • 列名可以是“Level”以提高性能。Column name can optionally be Level to improve performance.
    • 此列只能包含下列值之一:The column can only include the following values:
      • critical、crit、fatal、assert、highcritical, crit, fatal, assert, high
      • error、eerror, e
      • warning、w、monitorwarning, w, monitor
      • 信息information
      • verbose、verb、dverbose, verb, d

提供反馈Provide feedback

  1. 在应用程序的右上角,选择反馈图标

  2. 输入反馈,然后选择“提交”。Enter your feedback, then select Submit.

清理资源Clean up resources

未在此快速入门中创建任何资源,但如果要从应用程序中删除一个或两个群集,请右键单击群集并选择“删除连接”。You didn't create any resources in this quickstart, but if you'd like to remove one or both clusters from the application, right-click the cluster and select Remove connection. 另一种选择是从“设置” > “常规”选项卡中选择“清除本地状态” 。此操作将删除所有群集连接并关闭所有打开的查询选项卡。Another option is to select Clear local state from the Settings > General tab. This action will remove all cluster connections and close all open query tabs.

后续步骤Next steps

Azure 数据资源管理器的编写查询Write queries for Azure Data Explorer