KQL Support Matrix
VirtualMetric supports Kusto Query Language (KQL) as a first-class query interface for pipeline enrichment and federated search. You can write KQL queries against live documents, CSV lookup tables, datasets, and external storage such as local filesystems or S3 buckets — without needing to translate them into SQL by hand.
Internally, KQL queries are compiled to a target SQL dialect at runtime. The supported dialects are SQLite, MySQL, ClickHouse, PostgreSQL, and DuckDB. Because each dialect has different capabilities, some KQL constructs are fully supported, some are approximated with a warning, and others are unavailable in certain dialects.
DuckDB is PostgreSQL-compatible and, alongside ClickHouse, has the broadest analytical coverage. Its column is validated against a real DuckDB engine; a handful of functions are approximations, noted per row — for example
parse_url/parse_urlqueryextract only the common components,format_timespanignores the format string, andparse_ipv4returns the integer encoding.
Use this matrix as a reference when writing KQL for enrichment processors or federated search configurations. If a feature is marked ⚠️ or ❌ for your target dialect, check the notes column for the recommended alternative.
Legend: ✅ Supported · ⚠️ Approximated (semantics may differ, warning emitted at runtime) · ❌ Not Supported · 🔄 Rewritten (different but equivalent SQL)
A ⚠️ row produces a conversion warning, but whether you SEE it depends on the path. Kusto2SQLWithWarnings returns the warnings to its caller; Kusto2SQL — the entry point the lookup query path uses — drops them (pkg/kusto/main.go:475-478). Treat a ⚠️ as something to verify against known data rather than something the platform will tell you about at run time.
See Limitations for the five operators that are missing from the grammar entirely and therefore return a partial result rather than an error.
Contents
| Category | Description |
|---|---|
| Query Operators | Pipe operators such as where, project, summarize, join, union, and more |
| Join Types | All supported join kinds including semi, anti, and outer joins |
| String Operators | Equality, containment, prefix/suffix, regex, and set membership operators |
| Comparison & Filter Operators | Numeric comparisons, logical operators, bitwise operators, and identifier access |
| Scalar Functions — DateTime | now(), ago(), bin(), startofday(), datetime_diff(), and related functions |
| Scalar Functions — String | String manipulation including substring(), strcat(), split(), replace_regex(), and more |
| Scalar Functions — Math | Arithmetic, trigonometric, logarithmic, and numeric utility functions |
| Scalar Functions — Type Conversion | tostring(), toint(), todouble(), tobool(), and related casting functions |
| Scalar Functions — JSON / Dynamic | JSON extraction, packing, and dynamic value manipulation |
| Scalar Functions — Array / Set | Array operations, set logic, and series functions |
| Scalar Functions — Hash / Crypto | hash_md5(), hash_sha256(), hash_sha1(), and hash() |
| Scalar Functions — IP | parse_ipv4(), parse_ipv6(), ipv4_is_private() |
| Scalar Functions — Window | row_number(), prev(), next(), row_cumsum(), row_rank() |
| Aggregation Functions | count(), sum(), avg(), percentile(), make_list(), and more |
| Special Statements | datatable, duration literals, dynamic values, pipe chaining, and preprocessing |
| Limitations | Constructs that are not translated to SQL, and how they are reported |