cloudparts

Azure Data Explorer

Microsoft’s managed analytics database for logs, telemetry and time series, known internally as Kusto and queried with KQL; it began as the back end of Azure Monitor’s Log Analytics and Application Insights.

What it is
Real-time analytics databases
Used for
Logs,Time-series databases
Type
Managed service on Azure
Made by
Microsoft
License
Proprietary
Facts checked
24 October 2026
Website

What it is

Azure Data Explorer (ADX) is a cluster of virtual machines that holds databases of strongly typed tables. Ingested rows are written as extents, immutable horizontal shards of a table that start small and are merged in the background until each holds millions of rows. Every extent is compressed and indexed on its own, including full-text indexes on string columns and indexes on JSON-like dynamic columns, so a search for a term can skip most of the data. Persistent data lives in Azure Blob Storage; nodes cache extents on local SSD and in RAM, still compressed, under a cache policy that keeps recent data hot. Queries are compiled just in time to machine code, keep intermediate data in memory, and see a snapshot of the extents that existed when they started. Queued ingestion batches data from Event Hubs, IoT Hub, Event Grid, Kafka or the SDKs; streaming ingestion first lands small writes in a row store so they are queryable at once.

You query with the Kusto Query Language (KQL), a pipeline of operators such as where, summarize, join and render, with built-in functions for time series, anomaly detection, forecasting and geospatial work; a subset of T-SQL also works. Update policies transform rows as they arrive, materialized views keep aggregates current, and continuous export writes to Azure Data Lake Storage. KQL is also the query language of Azure Monitor Logs, Application Insights, Microsoft Defender and the eventhouses of Microsoft Fabric Real-Time Intelligence. Clusters are billed per minute for the VMs plus an ADX markup per vCore; a developer tier has no SLA, and a free cluster with about 100 GB of uncompressed storage needs no Azure subscription.

Why teams pick it

  • Ingests millions of events per second and answers ad-hoc queries over terabytes to petabytes of logs and telemetry in seconds
  • Indexes free text and semi-structured JSON on ingestion, so log search and analytics run in one store
  • KQL’s pipeline style and its time-series, anomaly and forecasting functions suit exploratory troubleshooting; the same skills carry over to Azure Monitor, Defender and Fabric
  • Storage is separate from compute: follower clusters can read the same data, and only recent data needs to sit in the hot cache

Watch out for

  • Azure only and proprietary; KQL is mostly used inside Microsoft products, so skills and queries don’t move easily to other databases
  • Extents are immutable: deletes and updates rewrite shards, and it is not a database for row-by-row changes
  • You size and pay for a running cluster, and the developer tier and free cluster have no SLA
  • Fabric eventhouses now offer KQL databases as SaaS on shared Fabric capacity, so new projects on Azure have two overlapping options

Good for

Specs

Compare with alternatives →
Data model
Strongly typed tables, with dynamic columns for JSON-like data
Query language
KQL (Kusto Query Language); a subset of T-SQL
Secondary indexes
Every extent indexed, including full-text on strings and dynamic columns
Consistency
A query sees a snapshot of the extents that existed when it started
How it scales
A cluster of VMs; follower clusters can read the same data
Storage format
Compressed, immutable extents in Azure Blob Storage, cached on SSD and in RAM
Ways to run it
Managed on Azure; KQL databases also run in Fabric eventhouses
Pricing model
Per minute for the VMs plus a markup per vCore; free cluster up to about 100 GB

Alternatives

What all real-time analytics databases have in common →Compare side by side →
ClickHouseOpen sourceAn open-source column-oriented database for real-time analytics, fast enough to serve dashboards over billions of rows.Apache DruidOpen sourceAn open-source real-time analytics database that makes Kafka and Kinesis events queryable within seconds and serves fast slice-and-dice queries to dashboards and APIs.Apache PinotOpen sourceA real-time distributed OLAP database from LinkedIn, built to answer analytics queries from end users in milliseconds at hundreds of thousands of queries per second, over data that arrived from Kafka seconds ago.Microsoft FabricAzureMicrosoft’s software-as-a-service analytics platform: Spark, a SQL warehouse, pipelines, a KQL eventhouse and Power BI all reading and writing one tenant-wide lake, OneLake, paid for from shared capacity.TinybirdCommercialA hosted ClickHouse platform that turns SQL queries into authenticated REST API endpoints, for analytics inside your product.FireboltCommercialA cloud data warehouse built for low-latency, high-concurrency queries behind apps and dashboards, also free to self-host as Firebolt Core.Alibaba Cloud HologresCommercialAlibaba Cloud’s PostgreSQL-compatible real-time data warehouse, which takes streaming writes, answers analytical queries and serves key lookups from one copy of the data.DatabendOpen sourceA cloud data warehouse written in Rust that keeps every table as Parquet blocks and Git-like snapshots in object storage, so stateless compute clusters can start, scale and stop without moving data. Open core: Apache 2.0, with paid features under the Elastic License 2.0.

How it fits with other technologies

KQL on the public StormEvents sample: filter, rank, add a computed column · text

StormEvents
| where State == 'TEXAS' and EventType == 'Flood'
| top 5 by DamageProperty desc
| project StartTime, EndTime, Duration = EndTime - StartTime, DamageProperty

See it in a real stack

No architecture uses Azure Data Explorer yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2014–2023

Kusto started inside Microsoft as a side project: a core team of four developers working on the Power BI service needed ad-hoc queries over Microsoft’s own telemetry stream, found nothing that fit, and built it. Other internal teams adopted it within months. It became the back end of Azure Log Analytics, Application Insights, Time Series Insights and Windows Defender Advanced Threat Protection, and by 2018 over 25,000 Microsoft employees used it regularly, with 200 PB of data available for query. Its largest internal table took about 200 billion records a day.

Microsoft announced a public preview as Azure Data Explorer at Ignite in September 2018, nearly five years after the project began, and made it generally available on 7 February 2019. Microsoft Fabric, announced in May 2023, added a real-time analytics workload; its eventhouses now hold KQL databases.

Why it’s built this way

Immutable shards in blob storage
Once written, an extent never changes, so nodes can cache it without coordinating, queries get snapshot isolation by listing extents, and compute can scale or fail over separately from storage.
Index text and JSON on ingestion, coarsely
Telemetry is full of free text and semi-structured fields. Term indexes kept per block of about 1,000 records stay small and fast to build, yet let queries skip most data.
Skip sorting data for compression
Sorting improves compression but costs a lot of CPU on free text, so ADX compresses with LZ4 by default and lets you set a row order only where queries need it, which keeps new data quickly available.
A pipeline query language
Exploring logs means narrowing down step by step, so KQL reads like a Unix pipeline: each operator takes a table and passes a table on.

Timeline

  1. 2014

    Kusto starts, around this year, as an internal project for Microsoft telemetry

  2. 2018

    Public preview as Azure Data Explorer at Ignite, in 41 regions (September)

  3. 2019

    Generally available on 7 February

  4. 2023

    Microsoft Fabric is announced with a real-time analytics workload

Sources7 · facts checked 24 October 2026

Improve this page on GitHub