Microsoft Fabric KQL Database (Eventhouse) Complete Guide: Real-Time Intelligence, Eventstream, Activator

A time-series and log-analytics database based on KQL (Kusto Query Language), offered in the Real-Time Intelligence workload of Microsoft Fabric. It is the Fabric edition of Azure Data Explorer (ADX), with feature and performance parity with ADX. Eventhouse is the parent resource of KQL Database, hosting multiple KQL Databases in a single Eventhouse. Typical use cases: 1) IoT device telemetry aggregation, 2) application log analysis (similar to Sentinel), 3) real-time dashboards (Power BI Direct Lake connection), 4) web traffic analysis, 5) fraud / anomaly detection. Using KQL instead of SQL has a learning curve, but for time-series / log analytics it is far more expressive than SQL, and you can operate it with the same language as Azure Monitor Log Analytics and Microsoft Sentinel.

Eventstream is the real-time data ingestion service in Microsoft Fabric Real-Time Intelligence, providing a streaming ingestion pipeline into KQL Database. Typical sources: 1) Azure Event Hub (Kafka compatible), 2) Azure IoT Hub, 3) Azure Service Bus, 4) Custom Endpoint (HTTP POST), 5) AWS Kinesis (via connector), 6) Google Cloud Pub/Sub. Typical transforms: 1) Filter (condition match), 2) Aggregate (time-window aggregation), 3) Transform (JSON Path / column transforms), 4) Union (merge multiple streams). Sinks: KQL Database (most common) / Lakehouse Delta Table / Custom Endpoint. A typical architecture is IoT Hub then Eventstream (Filter + Aggregate) then KQL Database then Power BI Direct Lake, achieving a real-time dashboard with only a few seconds of latency. It is ideal for low-latency IoT / Streaming Analytics requirements.

Real-Time Dashboard is a real-time analytics dashboard tool in Fabric Real-Time Intelligence. Using KQL Database directly as the source, it auto-refreshes every 5 seconds to always show the latest data. Key features: 1) tiles based on KQL queries (Chart / Stat Card / Table), 2) dynamic filtering via parameters (time range, region, category), 3) drill-down for detailed data, 4) conditional formatting (highlighting anomalies), 5) configurable auto-refresh. Typical use cases: 1) IoT device operational dashboards (real-time monitoring), 2) web traffic monitoring (PV / UU per second), 3) manufacturing line monitoring, 4) e-commerce sales dashboards (real-time sales), 5) security SOC dashboards (complementing Sentinel). Compared with Power BI Direct Lake: Real-Time Dashboard is 'always auto-refresh,' Power BI is 'manual refresh + rich visualization' — choose based on the use case.

Activator (formerly Data Activator / Fabric Reflex) is the data-driven action service in Fabric Real-Time Intelligence. It continuously monitors data patterns in KQL Database / Eventstream (anomalies, threshold breaches, trend changes) and triggers automated actions (email notifications, Teams messages, Power Automate workflows). Typical use cases: 1) IoT sensor detects temperature anomaly then alerts the facility manager, 2) web traffic detects bot attack then notifies the SOC, 3) e-commerce predicts stockout then triggers automatic reorder, 4) manufacturing detects defect-rate increase then alerts the plant manager, 5) streaming detects delay then pages engineering on-call. Conditions are configured through a GUI (Object / Property / Condition), so non-IT users can set them up — it is a strategic Microsoft service that lets business users design real-time actions. It is similar to Microsoft Sentinel's Logic App Playbooks, but Activator specializes in business scenarios.

Typical ingestion methods: 1) Eventstream (streaming; most recommended for real-time requirements), 2) Get Data button (one-time ingestion of small files: CSV / JSON / Parquet), 3) KQL .ingest command (run from a notebook or pipeline), 4) Continuous Data Ingestion (auto-ingest by monitoring a storage account), 5) Kusto Ingestion Client (.NET / Python / Java SDK), 6) Update Policy (auto-transform ingestion between tables), 7) Data Connection (external table). For batch ingestion, choose between Streaming Ingestion (sub-second latency) and Batching Ingestion (large volumes, minute-scale). Common patterns: streaming IoT data via Eventstream, bulk-loading historical data via Get Data, orchestrating multiple sources with a pipeline. KQL Database is designed for high-volume ingestion (TB to PB scale, millions of events per second).

KQL is a query language developed by Microsoft. It resembles SQL but uses a pipeline syntax: table name, then operator, then operator, etc., chained with `|`. Key operators: project (select columns), extend (add columns), summarize (aggregate), where (filter), join, union, parse (string parsing), extract (regex extraction), mv-expand (array expansion), bin (time bucketing), ago (past time), now (current time), make-set / make-list (array aggregation), dcount (distinct count), render (chart specification). Example: `TableName | where TimeGenerated > ago(1h) | summarize Count = count() by bin(TimeGenerated, 5m), UserName | render timechart`. See the Microsoft Sentinel KQL recipes article for more (same KQL language, same syntax). If you know SQL, you can catch up in a few days. KQL is a must-have skill across Microsoft data products (Sentinel, Azure Monitor, Fabric KQL DB).

Fabric KQL Database uses a single billing model based on Fabric Capacity Units (CU). Typical CU consumption: 1) ingestion via Eventstream (low-latency streaming consumes more CU; batching consumes less), 2) KQL query execution (more complex queries cost more), 3) Hot Cache memory usage, 4) Real-Time Dashboard auto-refresh (sub-second refresh is high CU). Cost-reduction tactics: 1) minimize the Hot Cache period to match business requirements (Hot is fast, Cold is cheap), 2) move old data to cold storage (automated via Retention Policy), 3) cache complex query results with Materialized Views, 4) build pre-aggregated tables at ingest time with Update Policy, 5) adjust Real-Time Dashboard refresh interval (5 sec to 30 sec yields a large reduction), 6) use Reserved Capacity. Fabric's shared CU design enables total cost management across workloads, and monthly right-sizing via the Capacity Metrics app is the standard pattern.

DP-700 (Fabric Data Engineer Associate) is the flagship certification for this area — its Domain 2 (Ingest and transform data, 30-35%) covers KQL Database, Eventstream, and Real-Time Intelligence in depth. SC-200 (Security Operations Analyst) uses KQL as a shared skill, AZ-104 (Administrator) Domain 5 covers Azure Monitor + KQL fundamentals, and MS-102 (Microsoft 365 Administrator Expert) covers Defender XDR Advanced Hunting (KQL-based). KQL is standard across Microsoft products, and Fabric KQL Database's importance in real-time analytics will only grow.