Azure / pykusto

Query Kusto like a pro from the comfort of your Jupyter notebook

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add support for ingestion_time()

netanz opened this issue · comments

In some tables, there is no "timestamp" field, but instead, we use the ingestion_time() function to filter the relevant period.

Working without it is unbearably slow and almost always fails as we can't filter first by timestamp.
That's why I think it's a relatively urgent feature.

usage example is
table
| where ingestion_time() between (ago(2h) .. now())
link -
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ingestiontimefunction?pivots=azuredataexplorer

I looked at the implementation of other functions, and I think this should be similar to now(), and therefore I think that adding the following function to "functions.py" should work. However, I don't understand why now() return StringExpression and not DateTimeExpression.

@staticmethod
def ingestion_time() -> StringExpression:
    """
    https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ingestiontimefunction
    """
    return StringExpression(KQL('ingestion_time()'))