Data Explorer KQL 過濾和映射列表中的 JSON（動態類型）

Question

我想過濾和轉換數組中的 JSON。

我有下表：

let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic([{"q": "foo", "type": "B1"}]),
    "name2", dynamic([{"q": "bar", "type": "C1"}, {"q": "bar2", "type": "B1"}]),
    "name3", dynamic([{"q": "foo", "type": "C1"}, {"q": "foo2", "type": "C1"}]),
    "name4", dynamic([{"q": "foo", "type": "B1"}]),
    "name5", dynamic([{"q": "b42", "type": "B1"}]),
    "name6", dynamic([{"q": "f42", "type": "C1"}]),
    "name7", dynamic([{"q": "foo", "type": "B1"}])
];

我想按“類型”字段過濾 JSON，並進行較小的轉換。 所以假設我想用“類型”“C1”進行過濾，所以我的 output 將是：

[
    "name2", dynamic([{"q": "bar", "type": "C1", "qtype": "barC1"}, {"q": "bar2", "type": "B1", "qtype": "bar2B1"}]),
    "name3", dynamic([{"q": "foo", "type": "C1", "qtype": "fooC1"}, {"q": "foo2", "type": "C1", "qtype": "foo2C1"}]),
    "name6", dynamic([{"q": "f42", "type": "C1", "qtype": "f42C1"}
]

我嘗試了以下內容：

fooTable
| mv-apply v=record on (
    where v.type == "C1"
    | extend r2 = pack(
        "q", v.q,
        "type", v.type,
        "qtype", strcat(v.q, v.type))
    | summarize record = make_list(r2)
    )
| project str, record

但如果類型不是“C1”，它只會在行中返回一個空數組：

name1   []
name2   [{"q":"bar","type":"C1","qtype":"barC1"}]
name3   [{"q":"foo","type":"C1","qtype":"fooC1"},{"q":"foo2","type":"C1","qtype":"foo2C1"}]
name4   []
name5   []
name6   [{"q":"f42","type":"C1","qtype":"f42C1"}]
name7   []

我想完全過濾這些行（沒有空行）。

Answer 1

這行得通嗎？

let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic([{"q": "foo", "type": "B1"}]),
    "name2", dynamic([{"q": "bar", "type": "C1"}, {"q": "bar2", "type": "B1"}]),
    "name3", dynamic([{"q": "foo", "type": "C1"}, {"q": "foo2", "type": "C1"}]),
    "name4", dynamic([{"q": "foo", "type": "B1"}]),
    "name5", dynamic([{"q": "b42", "type": "B1"}]),
    "name6", dynamic([{"q": "f42", "type": "C1"}]),
    "name7", dynamic([{"q": "foo", "type": "B1"}])
];
fooTable
| mv-apply record  on (
 where record.type=="C1"
)
 | summarize make_list(record) by str

字符串	列表記錄
名稱2	[ { “q”：“酒吧”， “類型”：“C1” } ]
名稱3	[ { “q”：“富”， “類型”：“C1” }, { “q”：“foo2”， “類型”：“C1” } ]
名稱6	[ { “q”：“f42”， “類型”：“C1” } ]

Answer 2

你可以試試這個：

• 首先過濾其任何成員具有type = C1的記錄
• 然后使用qtype bag_merge() function: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/bag-merge-function擴展記錄

let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic([{"q": "foo", "type": "B1"}]),
    "name2", dynamic([{"q": "bar", "type": "C1"}, {"q": "bar2", "type": "B1"}]),
    "name3", dynamic([{"q": "foo", "type": "C1"}, {"q": "foo2", "type": "C1"}]),
    "name4", dynamic([{"q": "foo", "type": "B1"}]),
    "name5", dynamic([{"q": "b42", "type": "B1"}]),
    "name6", dynamic([{"q": "f42", "type": "C1"}]),
    "name7", dynamic([{"q": "foo", "type": "B1"}])
];
fooTable
| where tostring(record) has '"type":"C1"'
| mv-apply r = record on ( 
    extend record = bag_merge(r, pack("qtype", strcat(r.q, r.type)))
    | summarize record = make_list(record)
)

Answer 3

這行得通嗎？

let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic([{"q": "foo", "type": "B1"}]),
    "name2", dynamic([{"q": "bar", "type": "C1"}, {"q": "bar2", "type": "B1"}]),
    "name3", dynamic([{"q": "foo", "type": "C1"}, {"q": "foo2", "type": "C1"}]),
    "name4", dynamic([{"q": "foo", "type": "B1"}]),
    "name5", dynamic([{"q": "b42", "type": "B1"}]),
    "name6", dynamic([{"q": "f42", "type": "C1"}]),
    "name7", dynamic([{"q": "foo", "type": "B1"}])
];
fooTable
| mv-apply record  on (
 where record.type=="C1"
)
| summarize make_list(record) by str

另一種選擇是：

let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic([{"q": "foo", "type": "B1"}]),
    "name2", dynamic([{"q": "bar", "type": "C1"}, {"q": "bar2", "type": "B1"}]),
    "name3", dynamic([{"q": "foo", "type": "C1"}, {"q": "foo2", "type": "C1"}]),
    "name4", dynamic([{"q": "foo", "type": "B1"}]),
    "name5", dynamic([{"q": "b42", "type": "B1"}]),
    "name6", dynamic([{"q": "f42", "type": "C1"}]),
    "name7", dynamic([{"q": "foo", "type": "B1"}])
];
fooTable
| mv-apply record  on (
 where record.type=="C1"
 | summarize make_list(record)
 | where array_length( list_record) > 0
)

字符串	列表記錄
名稱2	[ { “q”：“酒吧”， “類型”：“C1” } ]
名稱3	[ { “q”：“富”， “類型”：“C1” }, { “q”：“foo2”， “類型”：“C1” } ]
名稱6	[ { “q”：“f42”， “類型”：“C1” } ]