Add support for ingestion_time()
netanz opened this issue · comments
In some tables, there is no "timestamp" field, but instead, we use the ingestion_time() function to filter the relevant period.
Working without it is unbearably slow and almost always fails as we can't filter first by timestamp.
That's why I think it's a relatively urgent feature.
usage example is
table
| where ingestion_time() between (ago(2h) .. now())
link -
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ingestiontimefunction?pivots=azuredataexplorer
I looked at the implementation of other functions, and I think this should be similar to now(), and therefore I think that adding the following function to "functions.py" should work. However, I don't understand why now() return StringExpression and not DateTimeExpression.
@staticmethod
def ingestion_time() -> StringExpression:
"""
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ingestiontimefunction
"""
return StringExpression(KQL('ingestion_time()'))