Multiple where clauses vs. 'and' in kusto

Question

In terms of performance, is the following query

ResourceEvents
| where ResourceType == "Foo" and EventType == "Bar"

practically the same as

ResourceEvents
| where ResourceType == "Foo"
| where EventType == "Bar"

Or are the records filtered sequentially, performing two searches instead of one combined?

Chloric

Answer 1

both options are equivalent in terms of semantics and performance

Hasan

Answer 2

Adding to Yoni's answer, you can check it yourself by looking at the query plan.

.show queryplan  <|
StormEvents
| where State == "TEXAS" and EventType == "Flood"


.show queryplan  <|
StormEvents
| where State == "TEXAS" 
| where EventType == "Flood"

The plans are equivalent.

Increase

Is there documentation for .show queryplan, I can't find it learn.microsoft.com/en-us/search/… – Karney

Answer 3

In your exact scenario, it seems to be equivalent; but if you have heavy parsing, better use chained | where clause compare to a | where ... and .... Maybe have a look at kql query best practices > 'Lookup for rare keys/values in dynamic object'.

Thanks @sheldonzy! I didn't knew about .show queryplan. It seems to not be available when using log analytics sadly; but some testing can be achieved by running queries on Microsoft test ADX which is freely available.

Siana