Type Classes
Type classes group KQL types by shared behavior
A type class is a group of types that share a common behavior. When a function parameter has a type class like ordered instead of a specific type like string, it means the function accepts any type in that group.
ordered
An ordered type is any scalar type whose values can be compared and sorted using relational operators (<, >, <=, >=).
Ordered types: bool, int, long, real, decimal, string, datetime, timespan, guid
These types support:
T | sort by column asc
T | where value > threshold
T | where value between (start .. end)Functions like min() and max() accept any ordered type because they only need to compare values.
The dynamic type is not ordered — arrays and property bags have no natural ordering.
numeric
A numeric type supports arithmetic operations (+, -, *, /).
Numeric types: int, long, real, decimal
Functions like sum() and avg() accept numeric types because they perform arithmetic on values.
Note that datetime and timespan support some arithmetic (e.g., datetime - datetime produces a timespan) but are not considered numeric types.
any
any means the function accepts a value of any scalar type. Functions like count(), dcount(), and make_list() operate on any type because they don't inspect or transform the value itself.