Fabric Real-Time Analytics: KQL, Eventstream & Streaming Dashboards
Fabric Real-Time Analytics: KQL, Eventstream & Streaming Dashboards
Build real-time analytics with Microsoft Fabric — KQL databases, Eventstream ingestion, real-time dashboards, and IoT/streaming use cases.
Real-Time Intelligence in Microsoft Fabric enables streaming analytics, IoT monitoring, and live dashboards. This guide covers KQL databases, Eventstream, and real-time dashboard patterns.
What Is Real-Time Intelligence?
Real-Time Intelligence is a Fabric workload for analyzing streaming data: - Eventstream — Ingest streaming data from IoT devices, apps, and services - KQL Database — Store and query time-series data with Kusto Query Language - Real-Time Dashboards — Visualize streaming data with auto-refresh - Data Activator — Trigger automated actions based on data conditions
Eventstream: Data Ingestion
Eventstream connects to streaming sources: - Azure Event Hubs — High-throughput message ingestion - Azure IoT Hub — Device telemetry - Kafka — Open-source streaming platform - Custom apps — REST API push - Database CDC — Change data capture from SQL Server, PostgreSQL
Configuration: 1. Create an Eventstream in a Fabric workspace 2. Add a source (Event Hubs, IoT Hub, custom) 3. Add transformations (filter, aggregate, join) 4. Add a destination (KQL Database, Lakehouse, or both)
KQL Database: Storage & Query
KQL (Kusto Query Language) is optimized for time-series analytics:
Sample KQL Queries
Last 1 hour of sensor data: SensorData | where Timestamp > ago(1h) | summarize avg(Temperature) by bin(Timestamp, 5m), DeviceId
Anomaly detection: SensorData | make-series Temperature=avg(Temperature) on Timestamp step 1m | extend anomalies = series_decompose_anomalies(Temperature)
Top devices by error rate: DeviceEvents | where EventType == "Error" | summarize ErrorCount = count() by DeviceId | top 10 by ErrorCount
Real-Time Dashboards
Fabric Real-Time Dashboards auto-refresh as new data arrives: - Connect to KQL databases - Set refresh interval (seconds to minutes) - Use KQL queries as data sources for each tile - Combine with Power BI visuals for hybrid dashboards
Use Cases
IoT Monitoring - Factory floor sensor monitoring - Fleet vehicle tracking - Smart building energy management - Agricultural equipment telemetry
Application Analytics - Website clickstream analysis - Mobile app event tracking - API request monitoring - Error rate and latency dashboards
Security Operations - SIEM log analysis - Network traffic monitoring - Threat detection and alerting - Incident response dashboards
Financial Trading - Market data streaming - Trade execution monitoring - Risk limit alerting - Regulatory transaction reporting
Getting Started
Our Microsoft Fabric consulting team designs and implements real-time analytics solutions for enterprises. Contact us for a streaming analytics assessment.
Related resources: - What is Microsoft Fabric - OneLake guide - Fabric pricing
Frequently Asked Questions
What is KQL and how does it differ from SQL?
KQL (Kusto Query Language) is a read-only query language optimized for time-series data and log analytics. Unlike SQL which uses SELECT-FROM-WHERE, KQL uses a pipe syntax: tableName | where condition | summarize aggregation. KQL excels at time-based analysis, anomaly detection, pattern matching, and high-volume log querying. It powers Azure Data Explorer, Azure Monitor, Microsoft Sentinel, and now Fabric Real-Time Intelligence. SQL is better for transactional data; KQL is better for streaming/telemetry data.
Can Power BI connect to real-time Fabric data?
Yes. Power BI can visualize real-time Fabric data through: (1) Direct Lake mode for near-real-time access to OneLake Delta tables. (2) KQL database connections for streaming dashboards. (3) Fabric Real-Time Dashboards for auto-refreshing KQL visualizations. (4) DirectQuery to Fabric SQL endpoints for live queries. The choice depends on your latency requirements — from seconds (KQL dashboards) to minutes (Direct Lake).
How much does Fabric Real-Time Intelligence cost?
Real-Time Intelligence is included in your Fabric capacity (CU-based pricing starting at $262/month for F2). There is no separate charge for Eventstream, KQL databases, or Real-Time Dashboards — they consume CUs from your shared capacity. For high-volume streaming workloads (millions of events per second), you may need F16+ capacity. Eventstream sources (Event Hubs, IoT Hub) have their own Azure pricing separate from Fabric.