在Application Insights中使用Kusto从Json中提取字段

k10s72fa  于 2023-03-04  发布在  其他
关注(0)|答案(2)|浏览(137)

我在traces.customDimensions的特定字段中包含以下json:

当我解析这个Json来提取一个特定的值时,我总是得到一个空列,例如:

traces | order by timestamp desc
| project CurrentContext = parse_json(customDimensions.CurrentPluginContext)
| extend Source = CurrentContext.source
| project Source

查询返回以下内容:

我也试过:

traces | order by timestamp desc
| project timestamp, CurrentContext = customDimensions.CurrentPluginContext, CurrentParentContext = customDimensions.CurrentParentluginContext,
Source = parse_json(tostring(customDimensions.CurrentPluginContext)).source,
DepthCurrentContext = parse_json(tostring(customDimensions.CurrentPluginContext)).depth,
DepthCurrentParentContext = parse_json(tostring(customDimensions.CurrentParentluginContext)).depth
| mv-expand CurrentContext
| extend Source = CurrentContext.source

但是这里我也得到了一个空的"Source"列,而且列"DepthCurrentContext"和"DepthCurrentParentContext"甚至没有出现。

    • Json有效。**

我错过什么了吗?
任何帮助都非常感谢!

    • 2023年2月27日更新**

当我执行以下操作时:

let json = '{"source": "GetUserData","correlationId": "00000000-0000-0000-0000-000000000000","depth": "1","initiatingUserId": "00000000-0000-0000-0000-000000000000","isInTransaction": "False","isolationMode": "2","message": "Update","mode": "Asynchronus","operationId": "00000000-0000-0000-0000-000000000000","orgId": "00000000-0000-0000-0000-000000000000","orgName": "unqXXXXXXXXXXXXXXXXXXXX","requestId": "00000000-0000-0000-0000-000000000000","userId": "00000000-0000-0000-0000-000000000000","entityId": "00000000-0000-0000-0000-000000000000","entityName": "systemuser","type": "Plugin","stage": "Post-operation"}';

traces
| extend properties = parse_json(json)
| project Source = properties.source, CorrelationID = properties.correlationId

我从json中得到属性。json和日志中的ohne完全一样。
你知道吗?

2mbi3lxu

2mbi3lxu1#

documentation:您需要在内部属性包上使用tostring
parse_json(tostring(parse_json(customDimensions).CurrentPluginContext))

tsm1rwdh

tsm1rwdh2#

traces | order by timestamp desc
| project CurrentContext = parse_json(customDimensions.CurrentPluginContext)
| extend Source = parse_json(tostring(CurrentContext)).source
| project Source

相关问题