Home

Welcome to sKaleQL! This project provides a structured and efficient way to manage, execute, and organize Kusto Query Language (KQL) queries against Azure Log Analytics workspaces.

Overview

This repository serves as a template for organizing and executing KQL queries with features like:

• Structured Query Management: Organize queries in logical folders
• Flexible Output Formats: JSON, Table, TSV, YAML, and more
• Multiple Output Destinations: Console display or file output
• Advanced Transformations: Filter results using JMESPath queries
• Compression Options: Optimize storage with GZIP or ZIP compression
• Automation: GitHub Actions workflow for scheduled query execution
• Local Execution: Run queries from your development environment

Documentation

For detailed information on using this repository, refer to:

• Azure Guide: Azure setup
• GitHub Guide: GitHub Actions setup
• Configuration Guide: KQL config file format and options
• Usage Guide: General usage instructions

Note

The device folder under library is a sample folder containing example queries. You can create your own folders and queries as needed. All new folder must be created under the library directory.

Feedback

Found a bug or have an idea for improvement? Refer to the Feedback Guide for instructions on how to report issues or suggest features.

Getting Help

If you encounter any issues or have questions about using this repository, please check:

• The detailed documentation linked above
• GitHub Issues
• Contributing guidelines in the repository's CONTRIBUTING guidelines