如何使用Kusto在字符串中解析嵌套的JSON [英] How to parse nested JSON, within a string, using Kusto

问题描述

我有一个Python Azure函数，该函数执行时会生成自定义日志消息.我需要提取嵌套在日志消息中的一些JSON值.

如何使用Kusto在日志消息字符串中访问嵌套 JSON?

示例日志消息:

• 标有< ----------
的所需值

  ####### EventGrid触发器处理事件:{"id":长引导"，数据":{"api":"FlushWithClose"，" requestId":长引导"，"eTag":长引导"，"contentType":"application/octet-stream"，"contentLength":16264，< ----------------------"contentOffset":0，"blobType":"BlockBlob"，"blobUrl":"https://function.blob.core.windows.net/parentdir/childdir/file.name"，"URL":"https://function.dfs.core.windows.net/parentdir/childdir/file.name"，< ----仅在此处输入文件名音序器":长引导"，"identity":"long-guid"，"storageDiagnostics":{"batchId":长引导"；}}，"topic":"/subscriptions/long-guid/resourceGroups/resourceGroup/providers/Microsoft.Storage/storageAccounts/accountName"，" subject":"/blobServices/default/containers/containerName/blobs/childDir/file.name"，"event_type":"Microsoft.Storage.BlobCreated"；} ####### 

我想它与Kusto extend 函数有关，但是管道在...

  |扩展parsedMessage = todynamic(message)|项目时间戳，test = parsedMessage ["id"] 

...仅产生一个空的 test 列

解决方案

消息在您的特定情况下不是有效的JSON有效负载-因为它具有 ### ...EventGrid触发器处理事件:前缀(和类似的后缀).

• 这就是为什么 todynamic()无法对其进行处理的原因，以及为什么您不能在其中包含的JSON有效负载中引用属性.

理想情况下，您可以将摄取的有效负载更改为有效的JSON有效负载，然后将目标列重新输入为 dynamic (而不是 string ).

如果你不能这样做，你可以使用 substring() 函数或 parse 运算符来获取除上述前缀/后缀之外的所有内容，并解析输出 that 使用 todynamic()

• 尽管请注意，每次查询数据都会带来运行时开销，可以通过遵循上述建议来避免这种情况.

I have a Python Azure Function that produces custom logging messages when the Function executes. I need to pull out some of the JSON values nested in the logging message.

How can I use Kusto to access the nested JSON within the logging message string?

Example logging message:

• Desired values marked with <----------

####### EventGrid trigger processing an event: 
    {
        "id": "long-guid", 
        "data": {
            "api": "FlushWithClose", 
            "requestId": "long-guid", 
            "eTag": "long-guid", 
            "contentType": "application/octet-stream", 
            "contentLength": 16264, <----------------------
            "contentOffset": 0, 
            "blobType": "BlockBlob", 
            "blobUrl": "https://function.blob.core.windows.net/parentdir/childdir/file.name", 
            "url": "https://function.dfs.core.windows.net/parentdir/childdir/file.name", <---- JUST FILE.NAME here
            "sequencer": "long-guid", 
            "identity": "long-guid", 
            "storageDiagnostics": {
                "batchId": "long-guid"
            }
    }, 
    "topic": "/subscriptions/long-guid/resourceGroups/resourceGroup/providers/Microsoft.Storage/storageAccounts/accountName", 
    "subject": "/blobServices/default/containers/containerName/blobs/childDir/file.name",
    "event_type": "Microsoft.Storage.BlobCreated"
} #######

I imagine it has something to do with the Kusto extend function, but piping in...

| extend parsedMessage = todynamic(message)
| project timestamp, test = parsedMessage["id"]

...yields only an empty test column

解决方案

message in your specific case isn't a valid JSON payload - as it has the ###... EventGrid trigger processing an event: prefix (and a somewhat similar suffix).

• That is why todynamic() isn't able to process it and why you're not able to reference properties in the JSON payload that's included in it.

Ideally, you would change the payload you ingest to be a valid JSON payload, and re-type the target column to dynamic instead of string.

If you can't do that, you can use the substring() function or parse operator to get everything but the aforementioned prefix/suffix, and parse the output of that using todynamic()

• though note that doing that each time you query the data bears runtime overhead that could be avoided by following the advice above.

这篇关于如何使用Kusto在字符串中解析嵌套的JSON的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！