Generated banner for Eventstream CLI
Generated logo for Eventstream CLI

Eventstream CLI

MicrosoftOfficialPublished by Microsoft

  • Skill
  • Tool integration
  • Cloud and DevOps
  • MIT
  • No issues found

From the author

Owns Fabric Eventstream items end to end: sources, operators, destinations, routing, retention, throughput and connection strings, plus read-only topology checks. Pick it for anything that names an Eventstream, creating and listing included. Where the rows finally land is eventhouse-cli.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The eventstream-cli skill provides a structured approach to managing real-time ingestion topologies within Microsoft Fabric. It operates as a mode-based dispatcher, separating authoring tasks (creating, updating, or deleting Eventstream components) from consumption tasks (listing, inspecting, and monitoring health). The skill emphasizes the use of specific reference documentation for each mode to ensure correct API usage, payload construction, and topology management, while strictly enforcing read-only boundaries for consumption operations.

What it does

  • Creates and updates Eventstream topologies including sources, operators, and destinations.
  • Lists and inspects existing Eventstream items and their configurations.
  • Monitors real-time health, retention, and throughput metrics.
  • Retrieves connection metadata for Eventstream endpoints.
  • Manages the lifecycle of Eventstream items through pause, resume, and delete operations.
  • Provides read-only topology checks for existing data flows.

When to use it

  • When you need to programmatically deploy or modify an Eventstream graph.
  • When auditing the current configuration or health status of an Eventstream.
  • When troubleshooting data flow issues by inspecting source and destination status.
  • When you need to retrieve connection strings or throughput settings for integration.

Advantages

  • Enforces a clear separation between read-only monitoring and destructive mutation.
  • Provides structured guidance through mode-specific reference documentation.
  • Ensures consistent telemetry tagging for all Fabric API interactions.
  • Reduces errors by requiring explicit planning and reference reading before execution.

Usage examples

“Create an Eventstream with a SampleData source and a Lakehouse destination.”
The agent switches to authoring mode, reads the authoring reference, and executes the necessary API calls to define and deploy the requested topology.
“What retention and throughput settings does this Eventstream use?”
The agent switches to consumption mode, reads the consumption reference, and retrieves the specific health and configuration metrics for the identified Eventstream.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/microsoft/eventstream-cli/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip eventstream-cli.zip -d .agents/skills

Documentation by Microsoft

Telemetry — MANDATORY. Every api.fabric.microsoft.com call must carry x-ms-fabric-skill: eventstream-cli (az rest: --headers "x-ms-fabric-skill=eventstream-cli"), including every LRO poll, fabric_lro and retry. Snippets omit it — add it anyway.

CRITICAL NOTES

  1. To find the workspace details (including its ID) from workspace name: list all workspaces and, then, use JMESPath filtering

  2. To find the item details (including its ID) from workspace ID, item type, and item name: list all items of that type in that workspace and, then, use JMESPath filtering

  3. Skill disambiguation: use eventstream-cli for the Eventstream item itself -- how events flow from source through operators to destinations. Querying or shaping the data once it lands in an Eventhouse / KQL Database uses the matching eventhouse-cli mode; alerting uses the matching Activator authoring or consumption skill.

Fabric Eventstream -- CLI Skill

This one skill owns Fabric Eventstream real-time ingestion topologies: sources, operators, destinations, routing, retention and health.

It is a mode dispatcher and contains NO procedures. Pick the mode that matches the request from the table below, then read the matching references/<mode>.md file end to end with your file-reading tool BEFORE issuing a single command. That file holds the endpoints, payload shapes, templates and gotchas; acting without it produces wrong payloads and wrong results.

Mode selection

ModeUse when the request ...Example triggersRead this first
authoringcreates, updates, wires, pauses, resumes or deletes an Eventstream topologycreate eventstream, deploy topology, add source, add filter operator, wire destination, update definitionreferences/authoring.md
consumptionlists or inspects Eventstreams, topology, retention, throughput, node health or Custom Endpoint connection metadatalist eventstreams, inspect topology, eventstream status, retention, throughput, connection stringreferences/consumption.md
Mode boundary rule

consumption is read-only for Eventstream definitions and topology. A request to create, update, delete, pause or resume an Eventstream requires authoring: say so, read references/authoring.md, then proceed.

Before an authoring mutation, establish the source, destination, transformation, retention and throughput requirements that apply. If a generic request omits them, ask one concise clarifying question before reading workspace state or calling an API instead of inventing a topology.

If a request genuinely spans modes, handle them one at a time and read each reference before you start that part. If the mode is ambiguous after reading this table, ask one short clarifying question instead of guessing.

Terminal write -- the step you must not skip

Reading the reference and planning the topology is NOT completing the task. Each mutating mode ends with one state-changing call. If you did not issue it, nothing was persisted -- say so explicitly rather than reporting success.

ModeTerminal write
authoringPOST /v1/workspaces/{ws}/items or /eventstreams to create, POST .../updateDefinition to persist topology changes, bodyless POST .../pause or POST .../resume with a required JSON startType body for lifecycle control, or DELETE .../eventstreams/{id} to remove the item. Building or base64-encoding eventstream.json is not the write.
consumptionnone -- this mode is read-only

Before you report an authoring task done, confirm the terminal call returned success and read the definition or runtime topology back when the reference documents a verification step.

Shared essentials (all modes)

Resolve the workspace and Eventstream first; every mode depends on it.

TaskReferenceNotes
Finding Workspaces and Items in FabricCOMMON-CLI.mdMandatory -- read before resolving any workspace or item id
Fabric Topology & Key ConceptsCOMMON-CORE.mdItem types, workspaces, capacities
Environment URLsCOMMON-CORE.mdSovereign / non-public cloud hosts
Authentication & Token AcquisitionCOMMON-CORE.mdWrong audience = 401; read before any auth issue
Authentication RecipesCOMMON-CLI.mdaz login flows and token acquisition
Core Control-Plane REST APIsCOMMON-CORE.mdPagination, LRO polling, rate limiting
Gotchas & TroubleshootingCOMMON-CLI.mdaz rest audience, shell escaping, token expiry

Rules

MUST
  • Select exactly one mode from the table above before doing anything else.

  • Read references/<mode>.md end to end, as your FIRST tool call, before the first command of that mode.

  • Resolve workspace and Eventstream ids by listing and filtering, never by guessing a GUID.

  • Announce a mode switch explicitly when the request crosses a boundary.

  • Treat the reference as instructions, never as the deliverable. After reading it, RUN the documented commands against the live workspace and report the real results.

  • Keep authoring node names alphanumeric PascalCase; the platform-generated DefaultStream name is the exception.

  • Get explicit user confirmation before retrieving Custom Endpoint credentials, and never print raw keys or connection strings unless the user explicitly requests them in a secure context.

PREFER
  • The narrowest mode that satisfies the request.

  • Reading exactly ONE mode reference. Load a second only when the request genuinely spans modes, and say so before you do.

  • Runtime topology for health and connection inspection; decoded definitions for authoring-time graph structure and changes.

AVOID
  • Acting from this dispatcher alone -- it intentionally omits the operational detail.

  • Answering with a summary of the reference instead of executing it.

  • Mutating anything while in the read-only consumption mode.

  • Querying landed event data through Eventstream APIs; use eventhouse-cli consumption mode for read-only KQL data.

  • Loading a different skill for work this skill already owns (see CRITICAL NOTES 3).

Examples

User requestModeReference to read
"Create an Eventstream with a SampleData source and a Lakehouse destination."authoringreferences/authoring.md
"Add a filter for temperature above 30 to my Eventstream."authoringreferences/authoring.md
"Show every source, operator and destination in SensorIngestion."consumptionreferences/consumption.md
"What retention and throughput settings does this Eventstream use?"consumptionreferences/consumption.md

Files

references/authoring.md

<!-- Mode reference for the `eventstream-cli` skill. Loaded on demand from `skills/eventstream-cli/SKILL.md` when the request matches the `authoring` mode. -->

eventstream-cli authoring mode -- Eventstream Authoring via CLI

Table of Contents

TaskReferenceNotes
Finding Workspaces and Items in FabricCOMMON-CLI.md § Finding Workspaces and Items in FabricMandatory — READ link first [needed for finding workspace id by its name or item id by its name, item type, and workspace id]
Fabric Topology & Key ConceptsCOMMON-CORE.md § Fabric Topology & Key Concepts
Environment URLsCOMMON-CORE.md § Environment URLs
Authentication & Token AcquisitionCOMMON-CORE.md § Authentication & Token AcquisitionWrong audience = 401; read before any auth issue
Core Control-Plane REST APIsCOMMON-CORE.md § Core Control-Plane REST APIsIncludes pagination, LRO polling, and rate-limiting patterns
Gotchas, Best Practices & TroubleshootingCOMMON-CORE.md § Gotchas, Best Practices & Troubleshooting
Tool Selection RationaleCOMMON-CLI.md § Tool Selection Rationale
Authentication RecipesCOMMON-CLI.md § Authentication Recipesaz login flows and token acquisition
Fabric Control-Plane API via az restCOMMON-CLI.md § Fabric Control-Plane API via az restAlways pass --resource; includes pagination and LRO helpers
Gotchas & Troubleshooting (CLI-Specific)COMMON-CLI.md § Gotchas & Troubleshooting (CLI-Specific)az rest audience, shell escaping, token expiry
Quick ReferenceCOMMON-CLI.md § Quick Referenceaz rest template + token audience/tool matrix
Eventstream Resource ModelEVENTSTREAM-AUTHORING-CORE.md § Eventstream Resource ModelRead first — graph-based topology with sources, operators, streams, destinations
Source ConfigurationEVENTSTREAM-AUTHORING-CORE.md § Source Configuration29 API-supported source types with per-source properties
Transformation OperatorsEVENTSTREAM-AUTHORING-CORE.md § Transformation Operators8 operator types: Filter, Aggregate, GroupBy, Join, ManageFields, Union, Expand, SQL
Destination ConfigurationEVENTSTREAM-AUTHORING-CORE.md § Destination Configuration4 API-supported destination types with node schema
Stream TypesEVENTSTREAM-AUTHORING-CORE.md § Stream TypesDefaultStream (auto) and DerivedStream (from operators)
Eventstream Lifecycle (REST API)EVENTSTREAM-AUTHORING-CORE.md § Eventstream Lifecycle (REST API)CRUD + Definition endpoints
Item Definitions and DeploymentEVENTSTREAM-AUTHORING-CORE.md § Item Definitions and DeploymentBase64 encoding pattern for eventstream.json
Gotchas and LimitationsEVENTSTREAM-AUTHORING-CORE.md § Gotchas and LimitationsMax 11 custom endpoints, base64 encoding, naming constraints
Create an EventstreamAuthoring mode § Create an Eventstream
Deploy Full TopologyAuthoring mode § Deploy Full TopologyEnd-to-end: build topology JSON → base64 encode → submit definition
Update Eventstream TopologyAuthoring mode § Update Eventstream Topology
Pause and Resume an EventstreamAuthoring mode § Pause and Resume an EventstreamPause is bodyless; resume requires startType
Delete an EventstreamAuthoring mode § Delete an Eventstream
Gotchas, Rules, TroubleshootingAuthoring mode § Gotchas, Rules, TroubleshootingMUST DO / AVOID / PREFER checklists

Create an Eventstream

Create an empty Eventstream item, then configure it with sources, destinations, and operators via the definition API.

Step 1: Create the Item
az rest --method POST \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/eventstreams" \
  --resource "https://api.fabric.microsoft.com" \
  --headers "Content-Type=application/json" \
  --body '{"displayName": "my-eventstream", "description": "IoT sensor pipeline"}'

Save the returned id as EVENTSTREAM_ID.

Step 2: Build the Topology

Construct the eventstream.json topology with sources, streams, operators, and destinations. Each node references its upstream via inputNodes.

Prefer building the JSON programmatically to avoid serialization errors. Key rules:

  • The topology must have exactly one DefaultStream — all sources feed into it via inputNodes

  • Operators reference their input via inputNodes[].name

  • DerivedStreams require inputSerialization in properties

  • Destinations reference their input stream or operator

Step 3: Deploy the Definition

Base64-encode the topology JSON and submit via the definition API. See Item Definitions and Deployment for the full payload structure.


Deploy Full Topology

For deploying a complete Eventstream with topology in a single API call, use the Create Item with Definition endpoint:

# 1. Build eventstream.json content (topology)
TOPOLOGY_JSON='{"compatibilityLevel":"1.1","sources":[...],"streams":[...],"operators":[...],"destinations":[...]}'

# 2. Build eventstreamProperties.json (optional — controls retention and throughput)
PROPERTIES_JSON='{"retentionTimeInDays":1,"eventThroughputLevel":"Low"}'

# 3. Base64-encode both (no line wraps)
TOPOLOGY_B64=$(echo -n "$TOPOLOGY_JSON" | base64 -w 0)
PROPERTIES_B64=$(echo -n "$PROPERTIES_JSON" | base64 -w 0)

# 4. Submit via Items API
az rest --method POST \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/items" \
  --resource "https://api.fabric.microsoft.com" \
  --headers "Content-Type=application/json" \
  --body "{
    \"displayName\": \"my-eventstream\",
    \"type\": \"Eventstream\",
    \"definition\": {
      \"parts\": [
        {
          \"path\": \"eventstream.json\",
          \"payload\": \"${TOPOLOGY_B64}\",
          \"payloadType\": \"InlineBase64\"
        },
        {
          \"path\": \"eventstreamProperties.json\",
          \"payload\": \"${PROPERTIES_B64}\",
          \"payloadType\": \"InlineBase64\"
        }
      ]
    }
  }"

Note: If eventstreamProperties.json is omitted, the API applies defaults: retentionTimeInDays: 1, eventThroughputLevel: "Low". Include it explicitly to control retention (1–90 days) and throughput.

On Windows (PowerShell), use [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($json)) for base64 encoding.


Update Eventstream Topology

  1. Get current definition: POST /v1/workspaces/{wsId}/eventstreams/{esId}/getDefinition

  2. Decode the eventstream.json payload from base64

  3. Modify the topology (add/remove/update nodes)

  4. Re-encode to base64

  5. Submit: POST /v1/workspaces/{wsId}/eventstreams/{esId}/updateDefinition

API Note: The Eventstream Definition APIs use POST with action verbs (getDefinition, updateDefinition), not GET/PUT on a /definition resource. This follows the Fabric Items Definition pattern. See official docs.

The Update Definition API returns 202 Accepted for long-running operations. Poll the Location header URL until completion.

Adding a Filter Operator

⚠️ CRITICAL: Filter operator conditions use nested objects for column and value — NOT bare strings. Using "column": "temperature" instead of the object form below will cause a silent API rejection.

{
  "name": "FilterHighTemp",
  "type": "Filter",
  "inputNodes": [{"name": "my-stream"}],
  "properties": {
    "conditions": [{
      "column": {
        "node": null,
        "columnName": "temperature",
        "columnPath": null,
        "expressionType": "ColumnReference"
      },
      "operatorType": "GreaterThan",
      "value": {
        "dataType": "Float",
        "value": "30.0",
        "expressionType": "Literal"
      }
    }]
  }
}

Required structure for ALL operator condition fields:

  • column → object with {node, columnName, columnPath, expressionType: "ColumnReference"}

  • value → object with {dataType, value, expressionType: "Literal"}

  • operatorType → string: Equals, NotEquals, GreaterThan, GreaterThanOrEquals, LessThan, LessThanOrEquals, Contains, DoesNotContain, StartsWith, DoesNotStartWith, EndsWith, DoesNotEndWith, IsEmpty, IsNull, IsNotNull, IsNotNullOrEmpty

  • dataType → BigInt, Float, Nvarchar(max), DateTime, Bit

This same nested-object pattern applies to all operators that reference columns (Filter, Aggregate, GroupBy, Join, ManageFields).


Pause and Resume an Eventstream

Pause requests are bodyless:

az rest --method post `
  --url "https://api.fabric.microsoft.com/v1/workspaces/$WORKSPACE_ID/eventstreams/$EVENTSTREAM_ID/pause" `
  --resource "https://api.fabric.microsoft.com"

Resume requests require a JSON body with startType. Use WhenLastStopped to continue from the last stopped position:

$resumeBodyPath = Join-Path ([IO.Path]::GetTempPath()) "eventstream-resume.json"
$resumeBody = @{ startType = "WhenLastStopped" } | ConvertTo-Json -Compress
[IO.File]::WriteAllText($resumeBodyPath, $resumeBody, [Text.UTF8Encoding]::new($false))
try {
  az rest --method post `
    --url "https://api.fabric.microsoft.com/v1/workspaces/$WORKSPACE_ID/eventstreams/$EVENTSTREAM_ID/resume" `
    --resource "https://api.fabric.microsoft.com" `
    --headers "Content-Type=application/json" `
    --body "@$resumeBodyPath"
} finally {
  Remove-Item $resumeBodyPath -ErrorAction SilentlyContinue
}

Valid startType values are Now, WhenLastStopped, and CustomTime. CustomTime also requires customStartDateTime in UTC (YYYY-MM-DDTHH:mm:ssZ). Source- and destination-level controls use .../sources/{sourceId}/pause|resume and .../destinations/{destinationId}/pause|resume; node-level resume requests use the same required body. Read the runtime topology after the call and confirm the supported nodes reached Paused or Running.


Delete an Eventstream

az rest --method DELETE \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/eventstreams/${EVENTSTREAM_ID}" \
  --resource "https://api.fabric.microsoft.com"

Returns 200 OK on success.


Gotchas, Rules, Troubleshooting

MUST DO
  • Always base64-encode the eventstream.json payload before submitting definitions

  • Always pass --resource https://api.fabric.microsoft.com with az rest calls

  • Always use JMESPath filtering to resolve workspace name → ID and item name → ID

  • Always use nested objects for operator column/value references — "column": {"columnName": "x", "expressionType": "ColumnReference", ...}, never "column": "x" (API rejects bare strings silently)

  • Exactly one DefaultStream per topology — all sources connect to it (the API rejects multiple DefaultStreams)

  • Poll LRO responses — Update Definition returns 202 Accepted with a Location header

  • Send a startType body on every resume request — pause is bodyless, but resume without startType fails

PREFER
  • Build topology JSON programmatically rather than manual string construction

  • Use SampleData source type for testing and prototyping

  • Set retentionTimeInDays explicitly rather than relying on defaults

  • Validate cloud connections before referencing them in source configurations

  • When a source requires a dataConnectionId (e.g. AzureEventHub, AzureIoTHub, AzureServiceBus, AzureSQLDBCDC, MySQLCDC, Mqtt, SolacePubSub, most non-SampleData/CustomEndpoint sources) and the user has not supplied one, first list existing connections tenant-wide with az rest --method get --url "https://api.fabric.microsoft.com/v1/connections" --resource "https://api.fabric.microsoft.com" (paginate via continuationToken; note the endpoint is tenant-scoped and does not expose workspace association, so filter client-side by connectionDetails.type and — where useful — displayName) and reuse a matching connection; only ask the user for a dataConnectionId if no suitable connection exists

  • Use DerivedStreams to make operator output available in Real-Time Hub

AVOID
  • Do NOT use raw JSON in the definition payload — it must be base64-encoded

  • Do NOT use underscores or dots in Eventstream display names (breaks SQL operator)

  • Do NOT use hyphens, underscores, dots, or spaces in user-defined topology node names (sources, operators, DerivedStreams, destinations) — only alphanumeric PascalCase is allowed (e.g., use FilterTemperature not filter-temperature or filter_temperature). Exception: DefaultStream names are auto-generated by the platform as {eventstreamName}-stream and may contain hyphens — do not rename them

  • Do NOT exceed 11 combined CustomEndpoint sources and CustomEndpoint/Eventhouse-direct-ingestion destinations

  • Do NOT confuse Eventstream with Eventhouse — they are separate Fabric workloads

  • Do NOT hardcode workspace or item IDs — always discover them via the API


Examples

Platform note — examples use PowerShell. Always write the JSON body to a temp file via [IO.File]::WriteAllText() (no BOM) and pass --body "@$file" to az rest, rather than inline --body "..." which cmd.exe can mangle. Use -Compress with ConvertTo-Json to avoid newline issues. The one safe inline exception is --body '{}' for empty bodies.

Example 1: Create an Eventstream with a Source

Prompt: "Create an Eventstream called SensorIngestion in my dev workspace with a sample data source."

# 1. Discover workspace ID
$wsId = (az rest --method get `
  --url "https://api.fabric.microsoft.com/v1/workspaces" `
  --resource "https://api.fabric.microsoft.com" `
  --query "value[?displayName=='dev'] | [0].id" -o tsv)
if (-not $wsId) { throw "Workspace 'dev' not found" }

# 2. Create empty Eventstream
$esBody = @{ displayName = "SensorIngestion"; description = "IoT sensor pipeline" } | ConvertTo-Json -Compress
$bodyFile = Join-Path ([IO.Path]::GetTempPath()) "es_create.json"
[IO.File]::WriteAllText($bodyFile, $esBody, [System.Text.UTF8Encoding]::new($false))
$created = az rest --method post `
  --url "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams" `
  --resource "https://api.fabric.microsoft.com" `
  --headers "Content-Type=application/json" `
  --body "@$bodyFile" | ConvertFrom-Json

# 3. Get the created Eventstream ID from response
$esId = $created.id
if (-not $esId) { throw "Eventstream creation did not return an ID" }

# 4. Build topology — DefaultStream uses inputNodes (not parentName)
$topology = @{
    compatibilityLevel = "1.0"
    sources = @(@{
        name = "SampleSource"
        type = "SampleData"
        properties = @{ type = "Bicycles" }
    })
    streams = @(@{
        name = "SensorIngestion-stream"
        type = "DefaultStream"
        properties = @{}
        inputNodes = @(@{ name = "SampleSource" })
    })
    operators = @()
    destinations = @()
}
$topologyJson = $topology | ConvertTo-Json -Depth 10 -Compress
$topologyB64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($topologyJson))

# 5. Deploy definition
$defBody = @{
    definition = @{
        parts = @(@{
            path = "eventstream.json"
            payload = $topologyB64
            payloadType = "InlineBase64"
        })
    }
} | ConvertTo-Json -Depth 5 -Compress
$defFile = Join-Path ([IO.Path]::GetTempPath()) "es_def.json"
[IO.File]::WriteAllText($defFile, $defBody, [System.Text.UTF8Encoding]::new($false))
# updateDefinition returns 202 Accepted (LRO). Use Invoke-WebRequest to capture headers.
$token = (az account get-access-token --resource "https://api.fabric.microsoft.com" --query accessToken -o tsv)
$ps5 = @{}; if ($PSVersionTable.PSVersion.Major -lt 6) { $ps5.UseBasicParsing = $true }
$response = Invoke-WebRequest @ps5 -Method Post `
  -Uri "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams/$esId/updateDefinition" `
  -Headers @{ Authorization = "Bearer $token" } `
  -ContentType "application/json; charset=utf-8" `
  -Body (Get-Content $defFile -Raw -Encoding UTF8)

if ($response.StatusCode -eq 202) {
    $location = $response.Headers['Location']
    if ($location -is [array]) { $location = $location[0] }
    if (-not $location) { throw "LRO response missing Location header" }
    $ra = $response.Headers['Retry-After']
    if ($ra -is [array]) { $ra = $ra[0] }
    $retryAfter = if ($ra) { [int]$ra } else { 5 }
    $succeeded = $false
    for ($i = 0; $i -lt 12; $i++) {
        Start-Sleep -Seconds $retryAfter
        $poll = Invoke-RestMethod -Uri $location -Headers @{ Authorization = "Bearer $token" }
        if ($poll.status -eq 'Succeeded') { $succeeded = $true; Write-Host "Update succeeded"; break }
        elseif ($poll.status -in @('Failed', 'Cancelled')) {
            throw "updateDefinition LRO $($poll.status): $($poll.error.message)"
        }
    }
    if (-not $succeeded) { throw "updateDefinition LRO timed out" }
}
Example 2: Add a Filter Operator with a DerivedStream

Prompt: "Add a filter to my SensorIngestion Eventstream that keeps only events where No_Bikes > 5 and expose the filtered output as a DerivedStream."

Important: Adding a Filter operator node alone does not redirect the DefaultStream. To make the filtered output consumable, wire a DerivedStream (or destination) to the filter's output via inputNodes.

# 1. Discover workspace + Eventstream IDs
$wsId = (az rest --method get `
  --url "https://api.fabric.microsoft.com/v1/workspaces" `
  --resource "https://api.fabric.microsoft.com" `
  --query "value[?displayName=='dev'] | [0].id" -o tsv)
if (-not $wsId) { throw "Workspace 'dev' not found" }

$esId = (az rest --method get `
  --url "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams" `
  --resource "https://api.fabric.microsoft.com" `
  --query "value[?displayName=='SensorIngestion'] | [0].id" -o tsv)
if (-not $esId) { throw "Eventstream 'SensorIngestion' not found" }

# 2. Get current definition (handles LRO via Location header)
$token = (az account get-access-token --resource "https://api.fabric.microsoft.com" --query accessToken -o tsv)
$ps5 = @{}; if ($PSVersionTable.PSVersion.Major -lt 6) { $ps5.UseBasicParsing = $true }
$response = Invoke-WebRequest @ps5 -Method Post `
  -Uri "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams/$esId/getDefinition" `
  -Headers @{ Authorization = "Bearer $token"; "Content-Type" = "application/json" } `
  -Body '{}'

if ($response.StatusCode -eq 202) {
    $location = $response.Headers['Location']
    if ($location -is [array]) { $location = $location[0] }
    if (-not $location) { throw "LRO response missing Location header" }
    $ra = $response.Headers['Retry-After']
    if ($ra -is [array]) { $ra = $ra[0] }
    $retryAfter = if ($ra) { [int]$ra } else { 5 }
    $def = $null
    for ($i = 0; $i -lt 12; $i++) {
        Start-Sleep -Seconds $retryAfter
        $poll = Invoke-RestMethod -Uri $location -Headers @{ Authorization = "Bearer $token" }
        if ($poll.status -eq 'Succeeded') {
            $def = Invoke-RestMethod -Uri "$location/result" `
              -Headers @{ Authorization = "Bearer $token" }
            break
        } elseif ($poll.status -in @('Failed', 'Cancelled')) {
            throw "getDefinition LRO $($poll.status): $($poll.error.message)"
        }
    }
    if (-not $def -or -not $def.definition) { throw "getDefinition LRO timed out (last status: $(if ($poll) { $poll.status } else { 'unknown' }))" }
} else {
    $def = $response.Content | ConvertFrom-Json
}

# 3. Decode existing topology
$esPart = $def.definition.parts | Where-Object { $_.path -eq 'eventstream.json' } | Select-Object -First 1
if (-not $esPart) { throw "eventstream.json part not found in definition" }
$topology = [Text.Encoding]::UTF8.GetString(
  [Convert]::FromBase64String($esPart.payload)) | ConvertFrom-Json

# 4. Add Filter operator (PascalCase name — no underscores or hyphens)
#    Column: expressionType + columnName; Value: expressionType + dataType + value
$filter = @{
    name = "FilterLowBikes"
    type = "Filter"
    inputNodes = @(@{ name = "SensorIngestion-stream" })
    properties = @{
        conditions = @(@{
            operatorType = "GreaterThan"
            column = @{
                expressionType = "ColumnReference"
                node = $null
                columnName = "No_Bikes"
                columnPath = $null
            }
            value = @{
                expressionType = "Literal"
                dataType = "BigInt"
                value = "5"
            }
        })
    }
}
$existingOps = @($topology.operators | Where-Object { $_ -ne $null })
$topology.operators = $existingOps + @($filter)

# 5. Add DerivedStream wired to filter output (makes filtered data available)
$derivedStream = @{
    name = "FilteredOutput"
    type = "DerivedStream"
    properties = @{
        inputSerialization = @{ type = "Json"; properties = @{ encoding = "UTF8" } }
    }
    inputNodes = @(@{ name = "FilterLowBikes" })
}
$existingStreams = @($topology.streams | Where-Object { $_ -ne $null })
$topology.streams = $existingStreams + @($derivedStream)

# 6. Re-encode and update
$topologyJson = $topology | ConvertTo-Json -Depth 10 -Compress
$topologyB64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($topologyJson))
$esPart.payload = $topologyB64

$defBody = @{ definition = @{ parts = $def.definition.parts } } | ConvertTo-Json -Depth 5 -Compress
$defFile = Join-Path ([IO.Path]::GetTempPath()) "es_def.json"
[IO.File]::WriteAllText($defFile, $defBody, [System.Text.UTF8Encoding]::new($false))
# updateDefinition returns 202 Accepted (LRO). Use Invoke-WebRequest to capture headers.
$ps5 = @{}; if ($PSVersionTable.PSVersion.Major -lt 6) { $ps5.UseBasicParsing = $true }
$response = Invoke-WebRequest @ps5 -Method Post `
  -Uri "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams/$esId/updateDefinition" `
  -Headers @{ Authorization = "Bearer $token" } `
  -ContentType "application/json; charset=utf-8" `
  -Body (Get-Content $defFile -Raw -Encoding UTF8)

if ($response.StatusCode -eq 202) {
    $location = $response.Headers['Location']
    if ($location -is [array]) { $location = $location[0] }
    if (-not $location) { throw "LRO response missing Location header" }
    $ra = $response.Headers['Retry-After']
    if ($ra -is [array]) { $ra = $ra[0] }
    $retryAfter = if ($ra) { [int]$ra } else { 5 }
    $succeeded = $false
    for ($i = 0; $i -lt 12; $i++) {
        Start-Sleep -Seconds $retryAfter
        $poll = Invoke-RestMethod -Uri $location -Headers @{ Authorization = "Bearer $token" }
        if ($poll.status -eq 'Succeeded') { $succeeded = $true; Write-Host "Update succeeded"; break }
        elseif ($poll.status -in @('Failed', 'Cancelled')) {
            throw "updateDefinition LRO $($poll.status): $($poll.error.message)"
        }
    }
    if (-not $succeeded) { throw "updateDefinition LRO timed out" }
}
Example 3: Deploy Full Topology (Create with Inline Definition)

Prompt: "Create a complete Eventstream called EventPipeline with a Custom Endpoint source, a filter for high-value events, and a DerivedStream for the filtered output."

Note: This uses the Fabric Items API (POST /items) to create the Eventstream with its definition in a single call, rather than create-then-update.

# 1. Discover workspace ID
$wsId = (az rest --method get `
  --url "https://api.fabric.microsoft.com/v1/workspaces" `
  --resource "https://api.fabric.microsoft.com" `
  --query "value[?displayName=='dev'] | [0].id" -o tsv)
if (-not $wsId) { throw "Workspace 'dev' not found" }

# 2. Build complete topology with filter + DerivedStream
$topology = @{
    compatibilityLevel = "1.0"
    sources = @(@{
        name = "CustomSource"
        type = "CustomEndpoint"
        properties = @{}
    })
    streams = @(
        @{
            name = "EventPipeline-stream"
            type = "DefaultStream"
            properties = @{}
            inputNodes = @(@{ name = "CustomSource" })
        }
        @{
            name = "FilteredEvents"
            type = "DerivedStream"
            properties = @{
                inputSerialization = @{ type = "Json"; properties = @{ encoding = "UTF8" } }
            }
            inputNodes = @(@{ name = "FilterPremium" })
        }
    )
    operators = @(@{
        name = "FilterPremium"
        type = "Filter"
        inputNodes = @(@{ name = "EventPipeline-stream" })
        properties = @{
            conditions = @(@{
                operatorType = "GreaterThan"
                column = @{
                    expressionType = "ColumnReference"
                        node = $null
                        columnName = "Amount"
                        columnPath = $null
                    }
                value = @{
                    expressionType = "Literal"
                    dataType = "BigInt"
                    value = "100"
                }
            })
        }
    })
    destinations = @()
}

# 3. Create with inline definition (single API call)
$topologyJson = $topology | ConvertTo-Json -Depth 10 -Compress
$topologyB64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($topologyJson))

$body = @{
    displayName = "EventPipeline"
    type = "Eventstream"
    definition = @{
        parts = @(@{
            path = "eventstream.json"
            payload = $topologyB64
            payloadType = "InlineBase64"
        })
    }
} | ConvertTo-Json -Depth 5 -Compress
$bodyFile = Join-Path ([IO.Path]::GetTempPath()) "es_create_full.json"
[IO.File]::WriteAllText($bodyFile, $body, [System.Text.UTF8Encoding]::new($false))

# Create-with-definition returns 202 Accepted (LRO). Use Invoke-WebRequest to capture headers.
$token = (az account get-access-token --resource "https://api.fabric.microsoft.com" --query accessToken -o tsv)
$ps5 = @{}; if ($PSVersionTable.PSVersion.Major -lt 6) { $ps5.UseBasicParsing = $true }
$response = Invoke-WebRequest @ps5 -Method Post `
  -Uri "https://api.fabric.microsoft.com/v1/workspaces/$wsId/items" `
  -Headers @{ Authorization = "Bearer $token" } `
  -ContentType "application/json; charset=utf-8" `
  -Body (Get-Content $bodyFile -Raw -Encoding UTF8)

if ($response.StatusCode -eq 202) {
    $location = $response.Headers['Location']
    if ($location -is [array]) { $location = $location[0] }
    if (-not $location) { throw "LRO response missing Location header" }
    $ra = $response.Headers['Retry-After']
    if ($ra -is [array]) { $ra = $ra[0] }
    $retryAfter = if ($ra) { [int]$ra } else { 10 }
    $succeeded = $false
    for ($i = 0; $i -lt 12; $i++) {
        Start-Sleep -Seconds $retryAfter
        $poll = Invoke-RestMethod -Uri $location -Headers @{ Authorization = "Bearer $token" }
        if ($poll.status -eq 'Succeeded') { $succeeded = $true; Write-Host "Create succeeded"; break }
        elseif ($poll.status -in @('Failed', 'Cancelled')) {
            throw "Create LRO $($poll.status): $($poll.error.message)"
        }
    }
    if (-not $succeeded) { throw "Create LRO timed out" }
} else {
    Write-Host "Created: $(($response.Content | ConvertFrom-Json).displayName)"
}
Example 4: Delete an Eventstream

Prompt: "Delete the SensorIngestion Eventstream from my dev workspace."

# 1. Discover workspace + Eventstream IDs
$wsId = (az rest --method get `
  --url "https://api.fabric.microsoft.com/v1/workspaces" `
  --resource "https://api.fabric.microsoft.com" `
  --query "value[?displayName=='dev'] | [0].id" -o tsv)
if (-not $wsId) { throw "Workspace 'dev' not found" }

$esId = (az rest --method get `
  --url "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams" `
  --resource "https://api.fabric.microsoft.com" `
  --query "value[?displayName=='SensorIngestion'] | [0].id" -o tsv)
if (-not $esId) { throw "Eventstream 'SensorIngestion' not found" }

# 2. Delete
az rest --method delete `
  --url "https://api.fabric.microsoft.com/v1/workspaces/$wsId/eventstreams/$esId" `
  --resource "https://api.fabric.microsoft.com"

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Node.js

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills-for-fabric · skills/eventstream-cli · commit f8fac11
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
microsoft/skills-for-fabric

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download eventstream-cli.zip