Five KQL habits that make queries faster and cheaper

Most slow KQL queries are slow for the same few reasons. These five habits are the ones I check first when I review a query in an Eventhouse or Azure Data Explorer project.

1. Filter on time first

Time is the cheapest way to cut data. Put the time filter right after the table name, before any other where.

Events
| where Timestamp > ago(1h)
| where Level == "Error"

2. Use has instead of contains

has matches whole terms and uses the index. contains matches any substring and has to scan. If you are looking for a word, use has.

Events
| where Message has "timeout"

3. Project only what you need

Every column you carry through the query costs memory. project early, and avoid search * and find on large tables.

4. Summarize instead of returning raw rows

If you need a trend, let the engine aggregate with bin() and return a few hundred rows instead of millions.

Events
| where Timestamp > ago(7d)
| summarize Rows = count() by bin(Timestamp, 1h)
| render timechart

5. Parse once, at ingestion

If every query runs parse_json, extract or mv-expand on the same column, move that work into an update policy. The parsing happens once when data arrives, and every later query reads clean columns.

Want the rest?

The free KQL cheat sheet has these habits and many more, including joins, time series and materialized views. You can get it here.