eventhouse-cli

Author and query Fabric Eventhouse / KQL databases: create tables, functions, policies, materialized views and ingestion, or run read-only KQL for real-time…

npx skills add https://github.com/microsoft/skills-for-fabric --skill eventhouse-cli

Telemetry — MANDATORY. Every api.fabric.microsoft.com call must carry x-ms-fabric-skill: eventhouse-cli (az rest: --headers "x-ms-fabric-skill=eventhouse-cli"), including every LRO poll, fabric_lro and retry. Snippets omit it — add it anyway.

CRITICAL NOTES

  1. To find the workspace details (including its ID) from workspace name: list all workspaces and, then, use JMESPath filtering
  2. To find the item details (including its ID) from workspace ID, item type, and item name: list all items of that type in that workspace and, then, use JMESPath filtering
  3. Skill disambiguation: use eventhouse-cli for anything expressed in KQL or stored in a KQL Database. Use the matching eventstream-cli mode for streaming topology, and the matching sqldw-* skill for T-SQL against a Warehouse or Lakehouse SQL endpoint.

Fabric Eventhouse / KQL Database -- CLI Skill

This one skill owns Fabric Eventhouse and KQL Database: schema and ingestion management plus read-only KQL analytics.

It is a mode dispatcher and contains NO procedures. Pick the mode that matches the request from the table below, then read the matching references/<mode>.md file end to end with your file-reading tool BEFORE issuing a single command. That file holds the endpoints, payload shapes, templates and gotchas; acting without it produces wrong payloads and wrong results.

Mode selection

ModeUse when the request ...Example triggersRead this first
authoringruns KQL management commands (.create, .alter, .ingest, .drop), policies, mappings, functions or materialized viewscreate kql table, kql ingestion, kql retention policy, kql function, materialized view, kql mappingreferences/authoring.md
consumptionruns read-only KQL (where, summarize, join, render), discovers schema with .show, or monitors ingestion healthkql query, query eventhouse, time-series kql, show tables kql, explore eventhousereferences/consumption.md

Mode boundary rule

consumption may only issue read-only KQL and .show commands. Any dot-command that changes state (.create, .alter, .ingest, .drop, .set-or-append) requires the authoring mode: say so, read references/authoring.md, then proceed.

If a request genuinely spans modes, handle them one at a time and read each reference before you start that part. If the mode is ambiguous after reading this table, ask one short clarifying question instead of guessing.

Reference index

Read the mode reference first; open a topic file below only when the task needs it. Every reference is listed here, so read it from this table rather than following a link out of another reference.

ReferenceRead it when
references/authoring.mdany authoring request -- start here
references/authoring-core.mdyou need the capability matrix, table/schema, ingestion, policy, external table or permission detail behind an authoring task
references/authoring-advanced-operations.mdmaterialized views, stored functions, update policies, schema evolution, or monitoring authoring operations
references/authoring-scripts.mdyou want a ready-to-run script for create-and-ingest, schema deployment, export or policies -- run them from scripts/, do not read them
references/consumption.mdany consumption request -- start here
references/consumption-discovery-queries.mdyou need the .show discovery queries for schema, tables or ingestion health
EVENTHOUSE-CONSUMPTION-CORE.mdconnection fundamentals, schema discovery and security, monitoring, performance best practices, or common KQL query patterns -- read before writing KQL

Terminal write -- the step you must not skip

Reading the reference and planning the change is NOT completing the task. Each mutating mode ends with one state-changing call. If you did not issue it, nothing was persisted -- say so explicitly rather than reporting success.

ModeTerminal write
authoringPOST .../v1/rest/mgmt carrying the literal .create-merge table (or CREATE TABLE-equivalent), .alter or .ingest command. Composing the KQL management command and showing it to the user is not executing it.
consumptionnone -- this mode is read-only

Before you report the task done, confirm the terminal call returned success and, where the reference documents a readback, read the artefact back to prove the change landed.

Shared essentials (all modes)

Resolve the workspace and item first; every mode depends on it.

TaskReferenceNotes
Finding Workspaces and Items in FabricCOMMON-CLI.mdMandatory -- read before resolving any workspace or item id
Fabric Topology & Key ConceptsCOMMON-CORE.mdItem types, workspaces, capacities
Environment URLsCOMMON-CORE.mdSovereign / non-public cloud hosts
Authentication & Token AcquisitionCOMMON-CORE.mdWrong audience = 401; read before any auth issue
Authentication RecipesCOMMON-CLI.mdaz login flows and token acquisition
Core Control-Plane REST APIsCOMMON-CORE.mdPagination, LRO polling, rate limiting
Gotchas & TroubleshootingCOMMON-CLI.mdaz rest audience, shell escaping, token expiry

Rules

MUST

  • Select exactly one mode from the table above before doing anything else.
  • Read references/<mode>.md end to end, as your FIRST tool call, before the first command of that mode. Read it ONCE, in a single full read: do not re-open it, do not grep it again, and do not page through it. You already have it.
  • Apply the same read-once discipline to every other file you load, including nested references/<mode>/*.md sub-references and shared common/*.md files: open only the ones you actually need, read each ONCE end to end, and never grep or re-open one you already loaded.
  • Resolve workspace and item ids by listing and filtering, never by guessing a GUID.
  • Announce a mode switch explicitly when the request crosses a boundary.
  • Treat the reference as instructions, never as the deliverable. After reading it, RUN the documented commands against the live workspace and report the real results. Quoting what the reference says instead of executing it does not answer the request.

PREFER

  • The narrowest mode that satisfies the request.
  • Reading exactly ONE mode reference. Load a second only when the request genuinely spans modes, and say so before you do.
  • Reporting the mode you chose in your first response so the user can correct you.

AVOID

  • Acting from this dispatcher alone -- it intentionally omits the operational detail.
  • Answering with a summary of the reference instead of executing it.
  • Re-reading or re-grepping a reference you already loaded; it costs turns and tokens.
  • Mutating anything while in a read-only mode.
  • Loading a different skill for work this family already owns (see CRITICAL NOTES 3).

Examples

User requestModeReference to read
"How many events arrived per hour in the last day in the Telemetry eventhouse?"consumptionreferences/consumption.md
"Create a KQL table for the sensor feed and a 30-day retention policy."authoringreferences/authoring.md
"Show me the tables in the KQL database and their row counts."consumptionreferences/consumption.md

More skills from microsoft

oss-growth
microsoft
OSS growth hacker persona
agent-framework-azure-ai-py
microsoft
Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code interpreter, file search, web search), integrating MCP servers, managing conversation threads, or implementing streaming responses. Covers function tools, structured outputs, and multi-tool agents.
development
airunway-aks-setup
microsoft
Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: "setup AI Runway", "onboard AKS cluster", "install AI Runway", "airunway setup", "deploy model to AKS", "GPU inference on AKS", "KAITO setup on AKS", "run LLM on AKS", "vLLM on AKS", "set up model serving on AKS", "AI Runway controller".
devops
appinsights-instrumentation
microsoft
Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.
devops
applicationinsights-web-ts
microsoft
Instrument browser/web apps with the Application Insights JavaScript SDK (@microsoft/applicationinsights-web). Use for Real User Monitoring (RUM) — page views, clicks, AJAX/fetch dependencies, exceptions, custom events, and browser-side GenAI agent traces correlated to backend OpenTelemetry traces. Covers SDK Loader Script and npm setup, framework extensions (React, React Native, Angular), Click Analytics, telemetry initializers, and OTel GenAI semantic conventions for agent/tool/model spans emitted from the browser.
devops
azure-ai-anomalydetector-java
microsoft
Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate/multivariate anomaly detection, time-series analysis, or AI-powered monitoring.
development
azure-ai-language-conversations-py
microsoft
Implement Conversational Language Understanding (CLU) using the azure-ai-language-conversations Python SDK. Use when working with ConversationAnalysisClient to analyze conversation intent and entities, building NLP features, or integrating language understanding into applications.
development
azure-ai-ml-py
microsoft
Azure Machine Learning SDK v2 for Python. Use for ML workspaces, jobs, models, datasets, compute, and pipelines. Triggers: "azure-ai-ml", "MLClient", "workspace", "model registry", "training jobs", "datasets".
development