New Features for graph-match KQL Operator: Enhanced Pattern Matching and Cycle Control

We are excited to announce new features for graph-match, a Kusto Query Language (KQL) operator for finding pattern in graphs. These features will enhance your ability to express complex and flexible patterns and find more relevant matches.

• The cycles parameter: You can now control how cycles, or closed paths, are matched in the pattern. You can choose from three options: all, none, or unique_edges. The default option is unique_edges, which means that cycles are matched only if they do not include the same edge more than once. This can help you avoid redundant or overlapping matches. For example, if you want to match a triangle, you can use the pattern (a)--(b)--(c)--(a) with unique_edges, and it will not match a square that has the same three edges. If you want to match any cycle, regardless of the number of edges, you can use the option all. If you want to exclude cycles altogether, you can use the option none.
• The nonlinear patterns: You can now express nonlinear patterns, or patterns that have more than one sequence of edges, by using multiple comma delimited sequences. This can help you capture more complex structures and relationships in the graph. For example, if you want to match a star pattern, where a node n is connected to four other nodes a, b, c, and d, you can use the pattern (a)--(n)--(b),(c)--(n)--(d). The node n is shared by both sequences, indicating that they are connected. Note that only single connected component patterns are supported, meaning that all the nodes in the pattern must be reachable from each other.

We hope that these new features will help you explore and analyze your graphs more effectively and efficiently in Kusto. They are available on all services which are using the Kusto engine:Microsoft Fabric Real-Time Analytics, Azure Data Explorer, Azure Monitor and many others.

Learn more in our docs and play the Kusto Detective Agency Season 2 (powered by AMD). Please provide feedback.