Azure流分析中具有不同架构的多个警报联合

Question

I have an EventHub which receives events with JSON K/V pairs that can vary. What I want to do is run a single Stream Analytics job, and create multiple alerts while preserving all the K/V pairs in the result. For example, events like this might be seen:

{"temp1": 45, "temp2": 60, "source": "sensor-a"},
{"temp1": 37, "temp2": 50, "humidity": 17, "source": "new-sensor"}

I'm using humidity as an example, but the point is the keys vary.

One way that would work is if I could just run multiple select statements with my various WHERE clauses.

SELECT *, ALERT='Temp LOW' FROM [input] WHERE temp1 < 15
UNION
SELECT *, ALERT='Humidity HIGH' FROM [input] WHERE humidity > 50

But this won't work because SELECT * in ASA is not allowed with UNION. One way this could work is if the original data could be returned as a child named 'raw_data', for example. I'm not sure how / if I can make that happen. I need the other K/V pairs but I cannot know all the key names.

With the raw data as a child, the result might look like this:

{"ALERT": "Humidity HIGH", "raw_data":
  {"temp1": 33, "temp2": 52, "humidity": 60, "source": "sensorname", "otherkey": "value"}
}

One thing I thought might work is I could use a WITH statement to generate the ALERT field, and then use a JOIN to add to the event stream. I could generate a UUID for each event to JOIN ON. I haven't been able to figure this out yet.

Is there any way to do either returning the original event as a child in JSON, or to do the JOIN method to add the ALERT field?

Answer 1

Yes, you can make the nested record option work (where the original event is a child record in the result).

Here is modified example query from your question:

SELECT raw_data=[input], ALERT='Temp LOW' FROM [input] WHERE temp1 < 15
UNION
SELECT raw_data=[input], ALERT='Humidity HIGH' FROM [input] WHERE humidity > 50