KQL Support Matrix
VirtualMetric supports Kusto Query Language (KQL) as a first-class query interface for pipeline enrichment and federated search. You can write KQL queries against live documents, CSV lookup tables, datasets, and external storage such as local filesystems or S3 buckets — without needing to translate them into SQL by hand.
Internally, KQL queries are compiled to a target SQL dialect at runtime. The supported dialects are SQLite, MySQL, ClickHouse, and PostgreSQL. Because each dialect has different capabilities, some KQL constructs are fully supported, some are approximated with a warning, and others are unavailable in certain dialects.
Use this matrix as a reference when writing KQL for enrichment processors or federated search configurations. If a feature is marked ⚠️ or ❌ for your target dialect, check the notes column for the recommended alternative.
Legend: ✅ Supported · ⚠️ Approximated (semantics may differ, warning emitted at runtime) · ❌ Not Supported · 🔄 Rewritten (different but equivalent SQL)
Contents
| Category | Description |
|---|---|
| Query Operators | Pipe operators such as where, project, summarize, join, union, and more |
| Join Types | All supported join kinds including semi, anti, and outer joins |
| String Operators | Equality, containment, prefix/suffix, regex, and set membership operators |
| Comparison & Filter Operators | Numeric comparisons, logical operators, bitwise operators, and identifier access |
| Scalar Functions — DateTime | now(), ago(), bin(), startofday(), datetime_diff(), and related functions |
| Scalar Functions — String | String manipulation including substring(), strcat(), split(), replace_regex(), and more |
| Scalar Functions — Math | Arithmetic, trigonometric, logarithmic, and numeric utility functions |
| Scalar Functions — Type Conversion | tostring(), toint(), todouble(), tobool(), and related casting functions |
| Scalar Functions — JSON / Dynamic | JSON extraction, packing, and dynamic value manipulation |
| Scalar Functions — Array / Set | Array operations, set logic, and series functions |
| Scalar Functions — Hash / Crypto | hash_md5(), hash_sha256(), hash_sha1(), and hash() |
| Scalar Functions — IP | parse_ipv4(), parse_ipv6(), ipv4_is_private() |
| Scalar Functions — Window | row_number(), prev(), next(), row_cumsum(), row_rank() |
| Aggregation Functions | count(), sum(), avg(), percentile(), make_list(), and more |
| Special Statements | datatable, duration literals, dynamic values, pipe chaining, and preprocessing |