title: Kusto optimization to avoid time out
body: <p>I am looking to optimize my kusto query which is getting timeout in 10 mins. I have to usually run it for a week period so there is less limit on the time</p>
  <pre><code>AzureDiagnostics 
  | where TimeGenerated between (startofday(datetime(&quot;2022-03-26&quot;)) .. endofday(datetime(&quot;2022-04-04&quot;)))
  | where Category == 'kube-audit'
  | where log_s hasprefix '&quot;code&quot;:2'
  | where (strlen(log_s) &gt;= 32000
  and not(log_s has &quot;aksService&quot;) 
  and not(log_s has &quot;system:serviceaccount:crossplane-system:crossplane&quot;)
  and not(log_s has &quot;system:serviceaccount:elastic-system:elastic-operator&quot;)
  and not(log_s has &quot;system:serviceaccount:kube-system:daemon-set-controller&quot;)
  and not(log_s has &quot;system:serviceaccount:kube-system:deployment-controller&quot;)
  and not(log_s has &quot;system:serviceaccount:kube-system:endpoint-controller&quot;)
  and not(log_s has &quot;system:serviceaccount:kube-system:node-controller&quot;)
  and not(log_s has &quot;system:serviceaccount:kube-system:replicaset-controller&quot;)
  and not(log_s has &quot;system:serviceaccount:kube-system:statefulset-controller&quot;))
  or strlen(log_s) &lt; 32000
  | extend op = parse_json(log_s) 
  | where not(tostring(op.verb) in (&quot;list&quot;, &quot;get&quot;, &quot;watch&quot;))
  | where not(tostring(op.user.username) hasprefix &quot;system:&quot;)
  | where not(tostring(op.user.username) in (&quot;hcpService&quot;, &quot;aksService&quot;, &quot;aksProblemDetector&quot;, &quot;readinessChecker&quot;, &quot;nodeclient&quot;, &quot;masterclient&quot;))
  | where not(tostring(op.requestURI) in (&quot;/apis/authorization.k8s.io/v1/selfsubjectaccessreviews&quot;))
  | extend user = op.user.username
  | extend decision = tostring(parse_json(tostring(op.annotations)).[&quot;authorization.k8s.io/decision&quot;])
  | extend requestURI = tostring(op.requestURI)
  | extend name = tostring(parse_json(tostring(op.objectRef)).name)
  | extend namespace = tostring(parse_json(tostring(op.objectRef)).namespace)
  | extend verb = tostring(op.verb)
  | project TimeGenerated, SubscriptionId, ResourceId, namespace, name, requestURI, verb, decision, ['user']
  | order by TimeGenerated asc
  </code></pre>