多个条款与条款vs.＆＃x27; and＆＃x27;在库斯托
在性能方面，以下查询
ResourceEvents
| where ResourceType == "Foo" and EventType == "Bar"
几乎与记录依次过滤的记录相同
ResourceEvents
| where ResourceType == "Foo"
| where EventType == "Bar"
，或者执行两个搜索而不是一个组合搜索？
In terms of performance, is the following query
ResourceEvents
| where ResourceType == "Foo" and EventType == "Bar"
practically the same as
ResourceEvents
| where ResourceType == "Foo"
| where EventType == "Bar"
Or are the records filtered sequentially, performing two searches instead of one combined?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
在语义和性能方面，这两种选项都是等效的
both options are equivalent in terms of semantics and performance
添加到Yoni的答案中，您可以通过查看查询计划自己检查一下。
计划是等效的。
Adding to Yoni's answer, you can check it yourself by looking at the query plan.
The plans are equivalent.
在您的确切情况下，它似乎是等效的。但是，如果您进行大量解析，请更好地使用链式
|其中子句与|在哪里...和....也许看看＆gt; “在动态对象中查找稀有键/值”。
谢谢@sheldonzy！我不知道
.show queryplan。可悲的是使用日志分析时似乎无法使用。但是可以通过在In your exact scenario, it seems to be equivalent; but if you have heavy parsing, better use chained
| whereclause compare to a| where ... and ....Maybe have a look at kql query best practices > 'Lookup for rare keys/values in dynamic object'.
Thanks @sheldonzy! I didn't knew about
.show queryplan. It seems to not be available when using log analytics sadly; but some testing can be achieved by running queries on Microsoft test ADX which is freely available.