Skill Kql Queries Agent Skill
[Skill] kql, queries, log analytics, container logs - KQL query templates for Koji container logs, pod errors, restarts, Kubernetes events, build job activity, and node resource usage via Log Analytics.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/microsoft/azurelinux --skill skill-kql-queriesThe instruction itself
12 sections, as written by the authorKoji KQL Log Queries
Tools
| Tool | Purpose |
|------|---------|
| monitor_workspace_log_query | KQL queries across entire Log Analytics workspace |
| monitor_resource_log_query | KQL queries scoped to a specific resource |
| monitor_table_list | List available tables in the workspace |
Koji pod namespace
Koji pods run in the default namespace. Always filter:
Namespace == "default"(KubePodInventory, KubeEvents)PodNamespace == "default"(ContainerLogV2)- Combine with:
Name startswith "koji-"orPodName startswith "koji-"
Query reference
Pod health and status
KubePodInventory
| where Namespace == "default"
| where Name startswith "koji-"
| summarize arg_max(TimeGenerated, *) by Name
| project TimeGenerated, Name, ContainerStatus, ContainerRestartCount, PodRestartCount
| order by Name asc
Container errors (all Koji pods)
ContainerLogV2
| where PodNamespace == "default"
| where PodName startswith "koji-"
| where LogLevel == "error" or LogMessage contains "ERROR" or LogMessage contains "Traceback"
| project TimeGenerated, PodName, LogMessage
| order by TimeGenerated desc
| take 50
Koji Hub logs
ContainerLogV2
| where PodNamespace == "default"
| where PodName startswith "koji-hub"
| project TimeGenerated, PodName, LogMessage
| order by TimeGenerated desc
| take 100
Koji Builder logs
ContainerLogV2
| where PodNamespace == "default"
| where PodName startswith "koji-builder"
| project TimeGenerated, PodName, LogMessage
| order by TimeGenerated desc
| take 100
Node resource usage
Perf
| where ObjectName == "K8SNode"
| where CounterName in ("cpuUsageNanoCores", "cpuCapacityNanoCores", "memoryWorkingSetBytes", "memoryCapacityBytes")
| summarize AvgValue=avg(CounterValue) by Computer, CounterName
| evaluate pivot(CounterName, take_any(AvgValue))
| extend CPUPercent = round(cpuUsageNanoCores / cpuCapacityNanoCores * 100, 1),
MemPercent = round(memoryWorkingSetBytes / memoryCapacityBytes * 100, 1),
MemUsedGB = round(memoryWorkingSetBytes / 1073741824, 1),
MemCapGB = round(memoryCapacityBytes / 1073741824, 1)
| project Computer, CPUPercent, MemPercent, MemUsedGB, MemCapGB
| order by Computer asc
Pod restarts
KubePodInventory
| where Namespace == "default"
| where Name startswith "koji-"
| summarize MaxRestarts = max(ContainerRestartCount) by Name, ContainerName, ContainerStatus
| where MaxRestarts > 0
| order by MaxRestarts desc
Kubernetes warning events
KubeEvents
| where Namespace == "default"
| where Name startswith "koji-"
| where Reason in ("BackOff", "Unhealthy", "Failed", "Killing", "OOMKilling")
| project TimeGenerated, Name, Reason, Message
| order by TimeGenerated desc
| take 50
> KubeEvents may be empty under Group-Default DCR preset. Fall back to KubePodInventory restart counts.
Build job activity
ContainerLogV2
| where PodNamespace == "default"
| where PodName startswith "koji-builder"
| where LogMessage contains "build" or LogMessage contains "task"
| project TimeGenerated, PodName, LogMessage
| order by TimeGenerated desc
| take 100
Other skills for the same job
different authors, same section of the catalogue
Query the OFR (Office of Financial Research) Hedge Fund Monitor API for hedge fund data including SEC Form PF aggregated statistics, CFTC Traders in Financial Futures, FICC Sponsored Repo volumes, and FRB SCOOS dealer financing terms. Access time series data on hedge fund size, leverage, counterparties, liquidity, complexity, and risk management. No API key or registration required. Use when working with hedge fund data, systemic risk monitoring, financial stability research, hedge fund leverage or leverage ratios, counterparty concentration, Form PF statistics, repo market data, or OFR financial research data.
Design and automate Extract, Transform, Load data pipelines for data integration and analytics
Track and analyze US government shutdown liquidity impacts by monitoring TGA (Treasury General Account), bank reserves, EFFR, and SOFR data from FRED API. Use when user wants to (1) analyze current or past government shutdown effects on financial markets, (2) track liquidity conditions during fiscal policy disruptions, (3) assess "stealth tightening" effects, (4) compare shutdown episodes across different monetary policy regimes (QE vs QT), or (5) generate liquidity stress reports with historical context. Recommended usage frequency is weekly on Wednesdays after TGA/reserve data releases.
Auto-instrument Node.js applications with distributed tracing, metrics, and logs.
Azure Monitor Query SDK for Java. Execute Kusto queries against Log Analytics workspaces and query metrics from Azure resources.
Azure Monitor Query SDK for Python. Use for querying Log Analytics workspaces and Azure Monitor metrics.
Use this skill when you need to search Datadog logs, query metrics, tail logs in real-time, trace distributed requests, investigate errors, compare time periods, find log patterns, check service health, or export observability data.
Write comprehensive clinical reports including case reports (CARE guidelines), diagnostic reports (radiology/pathology/lab), clinical trial reports (ICH-E3, SAE, CSR), and patient documentation (SOAP, H&P, discharge summaries). Full support with templates, regulatory compliance (HIPAA, FDA, ICH-GCP), and validation tools.
How to use it
Take microsoft/skill-kql-queries from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.