使用Kusto在Application Insights中提取JSON中的字段

huangapple go评论63阅读模式
英文:

Extract fields from Json using Kusto in Application Insights

问题

以下是您要求的翻译:

I have the following json contained in a particular field in the traces.customDimensions:

当我解析此Json以提取特定值时,我总是得到一个空列,例如:

查询返回以下结果:

我也尝试过:

但在这里,我还得到了一个空的“Source”列。而且“DepthCurrentContext”和“DepthCurrentParentContext”列甚至都不显示。

Json是有效的。

我在这里漏掉了什么吗?

任何帮助都会非常感激!

更新 2023年2月27日

当我执行以下操作时:

我从Json中获取了属性。这个Json与日志中的Json完全相同。

有什么想法吗?

英文:

I have the following json contained in a particular field in the traces.customDimensions:

使用Kusto在Application Insights中提取JSON中的字段

When I parse this Json to extract a particular value I always get an empty column, for example:

traces | order by timestamp desc
| project CurrentContext = parse_json(customDimensions.CurrentPluginContext)
| extend Source = CurrentContext.source
| project Source

The query returns the following:

使用Kusto在Application Insights中提取JSON中的字段

I've also tried:

traces | order by timestamp desc
| project timestamp, CurrentContext = customDimensions.CurrentPluginContext, CurrentParentContext = customDimensions.CurrentParentluginContext,
Source = parse_json(tostring(customDimensions.CurrentPluginContext)).source,
DepthCurrentContext = parse_json(tostring(customDimensions.CurrentPluginContext)).depth,
DepthCurrentParentContext = parse_json(tostring(customDimensions.CurrentParentluginContext)).depth
| mv-expand CurrentContext
| extend Source = CurrentContext.source

But here I get also an empty "Source" column. And the Columns "DepthCurrentContext" and "DepthCurrentParentContext" do not even appear.

使用Kusto在Application Insights中提取JSON中的字段

The Json is valid.

Do I miss something here?

Any help is very appreciated!

UPDATE 27.02.2023

When I do the following:

let json = '{"source": "GetUserData","correlationId": "00000000-0000-0000-0000-000000000000","depth": "1","initiatingUserId": "00000000-0000-0000-0000-000000000000","isInTransaction": "False","isolationMode": "2","message": "Update","mode": "Asynchronus","operationId": "00000000-0000-0000-0000-000000000000","orgId": "00000000-0000-0000-0000-000000000000","orgName": "unqXXXXXXXXXXXXXXXXXXXX","requestId": "00000000-0000-0000-0000-000000000000","userId": "00000000-0000-0000-0000-000000000000","entityId": "00000000-0000-0000-0000-000000000000","entityName": "systemuser","type": "Plugin","stage": "Post-operation"}';

traces
| extend properties = parse_json(json)
| project Source = properties.source, CorrelationID = properties.correlationId

I get the properties out of the Json. The Json is the exact same as the ohne from the log.

Any idea?

答案1

得分: 3

如文档中所述1:您需要在内部属性包上使用tostring

parse_json(tostring(parse_json(customDimensions).CurrentPluginContext))

使用Kusto在Application Insights中提取JSON中的字段

英文:

as mentioned in the documentation: you will need to use tostring on the internal property bag.

i.e. parse_json(tostring(parse_json(customDimensions).CurrentPluginContext))

使用Kusto在Application Insights中提取JSON中的字段

答案2

得分: 0

traces | 按时间戳降序排序
| 提取 CurrentContext = 解析为 JSON 的 customDimensions.CurrentPluginContext
| 扩展 Source = 解析为 JSON 的 tostring(CurrentContext)).source
| 提取 Source
英文:
traces | order by timestamp desc
| project CurrentContext = parse_json(customDimensions.CurrentPluginContext)
| extend Source = parse_json(tostring(CurrentContext)).source
| project Source

huangapple
  • 本文由 发表于 2023年2月27日 14:48:34
  • 转载请务必保留本文链接:https://go.coder-hub.com/75577446.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定