How to select columns with project in KQL: example

The project operator is one of the most-used tools in KQL (Kusto Query Language) when you need to select columns: it lets you choose exactly which columns appear in the result, change their order and rename them. Using project well keeps your queries cleaner, easier to read and faster, because the query only carries the data you actually need.

Prerequisites

• Access to a KQL environment: a KQL database or Eventhouse in Microsoft Fabric, an Azure Data Explorer cluster, or the public help demo cluster.
• Knowing how to open the query editor and run a simple query.
• You don't need your own data: the examples create a sample table with the datatable operator.

Step 1: Create sample data with datatable

To follow the examples without depending on any existing table, we'll create a small sales table right inside the query, using the datatable operator. Copy this block into the editor and run it:

let Vendas = datatable(DataVenda:datetime, Produto:string, Regiao:string, Quantidade:int, PrecoUnitario:real)
[
    datetime(2026-07-01), "Teclado", "Norte",  3, 25.0,
    datetime(2026-07-01), "Rato",    "Sul",    5, 12.5,
    datetime(2026-07-02), "Monitor", "Norte",  2, 149.9,
    datetime(2026-07-02), "Teclado", "Centro", 4, 25.0
];
Vendas

When you run it, you should see four rows and five columns. This Vendas table is the basis for every step that follows, so keep the let block at the start of your query.

Step 2: Select columns with project

A real table often has dozens of columns, but usually you only need a few. With project you state which ones to keep, and all the others are dropped from the result:

Vendas
| project Produto, Quantidade, PrecoUnitario

The result now has just three columns. Besides making it easier to read, carrying fewer columns reduces the amount of data processed, which helps performance and cost on large tables. Note too that the order in the result follows the order in which you wrote the columns in project, not the table's original order.

Step 3: Reorder and rename columns

Since project defines the order, you just swap the names around to reorder the columns. To rename, use the syntax NewName = OriginalColumn:

Vendas
| project Regiao, Produto, Unidades = Quantidade

Now the Regiao column comes first and Quantidade is renamed to Unidades. Renaming is very handy for giving clearer titles when the result will feed a report or a dashboard.

Step 4: Create a calculated column inside project

project also accepts expressions, so you can compute new values without a separate extend. For example, the total of each row (quantity times price):

Vendas
| project Produto, Total = Quantidade * PrecoUnitario

The result shows Produto and a new Total column, calculated row by row.

Tip: use extend when you want to keep all columns and just add one more; use project when you want to keep only a subset of columns. That is the essential difference between the two operators.

Step 5: Drop or rename without listing everything

When you only want to remove one or two columns from a table with many, listing all the rest in project is tedious and error-prone. In that case use project-away, which removes only the columns you name and keeps the others:

Vendas
| project-away DataVenda

There is also project-keep, which does the opposite: it keeps only the columns you name (patterns allowed), handy when you want to keep a few out of many. And to rename without touching the other columns, use project-rename:

Vendas
| project-rename Preco = PrecoUnitario

This way you keep all the original columns and change only what you need.

Check the result

Run each example in the editor and check the number of columns, their names and order in the results grid: they should match exactly what you asked for in project. A good way to test is to compare the result of Vendas (the full table) with that of Vendas | project Produto, Quantidade — in the second case you should see fewer columns. If a column you expected has disappeared, check that you included it in the project list, since anything not listed is removed.

Conclusion

You now know how to use project to select, reorder, rename and compute columns, plus project-away, project-keep and project-rename for quick adjustments. The natural next step is to combine project with where to filter rows and with summarize to aggregate data. One final performance tip: place project early in the pipeline, right after your filters, to reduce the columns carried through the query. Which columns could your next query stop carrying?