在 kusto 中格式化結果

Question

示例在下面的示例中，我們需要匯總用戶日志。

datatable(user:string, dt:datetime,page: string, value:int)
[
    'chmod',        datetime(2019-07-15),   "page1", 1,
    'ls',           datetime(2019-07-02),   "page2", 2,
    'dir',          datetime(2019-07-22),   "page3", 3,
    'mkdir',        datetime(2019-07-14),   "page4", 4,
    'rm',           datetime(2019-07-27),   "page5", 5,
    'pwd',          datetime(2019-07-25),   "page6", 6,
    'rm',           datetime(2019-07-23),   "page7", 7,
    'pwd',          datetime(2019-07-25),   "page8", 8,
]
| summarize commands_details = make_list(pack('dt', dt, 'page', page, "value", value)) by user

結果最后一個示例查詢中的結果將類似於

"user": pwd,
"commands_details": [
    {
        "dt": "2019-07-25T00:00:00.0000000Z",
        "page": "page6",
        "value": 6
    },
    {
        "dt": "2019-07-25T00:00:00.0000000Z",
        "page": "page8",
        "value": 8
    }
],

預期結果，但我需要結果如下所示

"user": pwd,
"commands_details": [
    {
        "dt": "2019-07-25T00:00:00.0000000Z",
        "data":[
              {"page": "page6", "value": 6},
              {"page": "page8", "value": 8}
        ]
    }
],

問題是在 Kusto 中有什么方法可以像預期的部分那樣形成結果嗎？

Answer 1

您可以使用下一個查詢來實現此目的：

datatable(user:string, dt:datetime,page: string, value:int)
[
    'chmod',        datetime(2019-07-15),   "page1", 1,
    'ls',           datetime(2019-07-02),   "page2", 2,
    'dir',          datetime(2019-07-22),   "page3", 3,
    'mkdir',        datetime(2019-07-14),   "page4", 4,
    'rm',           datetime(2019-07-27),   "page5", 5,
    'pwd',          datetime(2019-07-25),   "page6", 6,
    'rm',           datetime(2019-07-23),   "page7", 7,
    'pwd',          datetime(2019-07-25),   "page8", 8,
]
| summarize commands_details = make_list(pack('page', page, "value", value)) by user, dt
| project result = pack('user', user, 'data', pack('dt', dt, 'data', commands_details))

結果（對於'pwd'）：

{
  "user": "pwd",
  "data": {
    "dt": "2019-07-25T00:00:00Z",
    "data": [
      {
        "page": "page6",
        "value": 6
      },
      {
        "page": "page8",
        "value": 8
      }
    ]
  }
}