Fluid Framework Kusto

Fluid Framework Kusto Reference

This skill provides a comprehensive reference for Fluid Framework telemetry investigation in Kusto. Load it whenever a Kusto query needs to be written, interpreted, or run against the Office Fluid database.

VPN required. The Office Fluid Kusto cluster (https://kusto.aria.microsoft.com) is only reachable on the Microsoft internal network. If a query fails to connect or returns no results unexpectedly, remind the user to check that their VPN is on before troubleshooting further.

Cluster & Access

Cluster: https://kusto.aria.microsoft.com
Primary database: Office Fluid
Database ID: 6a8929bcfc6d44e9b13fee392ada9cf0 (use this, not the pretty name, as the database parameter in kusto_query)
Automation/stress test database: Office Fluid Test
Database ID: 742fa5a288b045e5beab1a2b8e445a71 — contains office_fluid_ffautomation_* tables used for stress test / pipeline telemetry. These tables are NOT in the primary "Office Fluid" database.
Retention: ~28 days
VPN: Required (Microsoft internal network)
Access requirement: M365HeartbeatTenantUsers group membership

Quick Orientation

The primary tables are:

Office_Fluid_FluidRuntime_Error — all errors (first stop)
Office_Fluid_FluidRuntime_Performance — timing events
Office_Fluid_FluidRuntime_Generic — everything else
union Office_Fluid_FluidRuntime_* — all three at once
OwhLoads (stored function) — denominator for ICE/ACE error rate queries

Key correlation ID hierarchy: Session_Id/Data_hostCorrelationId → Data_pageCorrelationId → Data_docId → Data_containerId

Key deployment ring field: Loop_Audience (FluidRuntime tables), Release_AudienceGroup (OWH/QoS tables)

Using the Full Reference

Before writing any non-trivial Kusto query, read the full reference file:

references/kusto-query-reference.md

This reference contains:

Part 1 — All tables, fields, correlation IDs, version fields, stored functions, partner database schemas (OneNote, OWA, Loop FFX, Video, Scriptor, HostTracker, automation)
Part 2 — Query Cookbook with ~20 sections of ready-to-use queries (session lookup, error timecharts, breadth assessment, version correlation, ICE rate calculations, EU global queries, ODSP flight changes, etc.)
Part 3 — Investigation playbook patterns (incoming partner incident, dataCorruptionError triage, ICE error rate, important notes)
Part 4 — Additional query sections: FF bump tracking (5 queries), render reliability, Scriptor errors, Video telemetry (10+ queries), container reconnects / WhyIsTheContainerStuck(), stress test automation (FindBuildErrors, DidSummarizerRecover, SummarizerView)

Key Reminders

Always use absolute timestamps in IcM notes (not ago()) so queries remain reproducible
Always filter Data_stack !has '.goskope.com' and Data_channelFactoryType !has '.myshn.net' in corruption queries to exclude known reverse proxies
The hll() / dcount_hll(hll_merge(...)) pattern is required for EU-compliant distinct user counts across clusters
For EU data, use macro-expand force_remote = true officefluid_global as X (...) | summarize ...
Loop_Audience (FluidRuntime) and Release_AudienceGroup (OWH/QoS) are the same concept; filter == "Production" to exclude dogfood noise

README