kusto 中的多个 where 子句与“and”

Question

就性能而言，是以下查询

ResourceEvents
| where ResourceType == "Foo" and EventType == "Bar"

几乎与

ResourceEvents
| where ResourceType == "Foo"
| where EventType == "Bar"

或者记录是否按顺序过滤，执行两次搜索而不是组合一次？

Answer 1

两个选项在语义和性能方面是等效的

Answer 2

添加到 Yoni 的答案中，您可以通过查看查询计划自行检查。

.show queryplan  <|
StormEvents
| where State == "TEXAS" and EventType == "Flood"


.show queryplan  <|
StormEvents
| where State == "TEXAS" 
| where EventType == "Flood"

这些计划是等效的。