guid

A guid is a 128-bit identifier. Its spelling is formatting: 74BE27DE-1E4E-49D9-B579-FE0B331D3642, 74be27de-1e4e-49d9-b579-fe0b331d3642 and 74be27de1e4e49d9b579fe0b331d3642 are the same guid. A guid is shown lowercase and hyphenated, and it orders as that text does.

print g = guid(74be27de-1e4e-49d9-b579-fe0b331d3642)

Guids in your dataCopy Anchor Link

Your data stores a guid as text. A comparison with a guid reads the field as one, so the obvious query works and uses the index:

T | where request_id == guid(74be27de-1e4e-49d9-b579-fe0b331d3642)

The field matches when it holds the guid spelled hyphenated or as 32 hex digits, in any case. Any other value is not a guid, so it does not match. asguid() reads a value the same way, and annotate a field as guid to read it so throughout a query.

toguid() is a conversion: it reads more spellings, such as hyphens in other places, but it converts every value before comparing, so a filter on it cannot skip any data.

A guid is not textCopy Anchor Link

A string operator such as has or contains on a guid is an error, as on a number. Write tostring(g) to search its text, or search the field before you annotate it, which keeps the index.