在 Azure 数据资源管理器中聚合数组列的内容

Question

我有一些数据存储在 customEvents 属性包中，我想对其执行聚合和分析。我是分析查询的新手，您可以使用 Azure 数据资源管理器查询语言针对 AppInsights 运行，但我被卡住了。

我掌握了将属性包的键值对之一的内容转换为数字数组的方法（在下面的示例中，该输出由 items 表示）。

let items = parse_json('{"operation_Id": "12345Z12", "days":[43, 21, 65]}');
print items.operation_Id, items.days;

然而，当我需要为每个operation_Id计算数组中的项目的平均值时，我运行变成了文档墙。我查看了 mvexpand、let（使用 lambda 表达式）、datatable、使用动态数据类型等。使用 mvexpand 时遇到的阻塞问题是我想将输出中的每一行与其操作 operation_Id 相关联，而 mvexpand 似乎只在第一行中保持这种关系。对于 datatable，该类型不支持管道输入。

我遇到的另一个常见错误（包括来自下面的代码示例的是 Operator Source Expression should be table or column）。

let items = parse_json('{"days":[43, 21, 65]}');

let arraySum = (T:(x: long))
{
   T 
   | summarize sum(x) 
};
items
| project days | invoke arraySum()

如果有必要，我可以在JavaScript中执行聚合代码，只将计算出的平均值传递到属性包中，但是把原始数据值扔掉感觉很浪费。是否有一些明显的计算或聚合函数可以解决这个问题？

Answer 1

您可以根据自己的兴趣计算以下两个选项的平均值：

(警告：这是基于您展示的示例，可能 "dumbed down" 无法反映您的真实场景，因此请澄清以防万一很有帮助):

let items = dynamic({"operation_Id": "12345Z12", "days":[43, 21, 65]});
print operationId = tostring(items.operation_Id), days = items.days
| mvexpand days to typeof(int)
| summarize avg(days) by operationId

// or

let items = dynamic({"operation_Id": "12345Z12", "days":[43, 21, 65]});
print operationId = tostring(items.operation_Id), days = items.days
| project operationId, series_stats_dynamic(days)['avg']

您的第二个示例确实无效（标量和表格参数并非生而平等），但可以重写如下：

(与上述警告相同)

let items = dynamic({"days":[43, 21, 65]});
let arraySum = (T:(x: long))
{
   T 
   | summarize sum(x) 
};
print items 
| mvexpand x = items.days to typeof(long)
| invoke arraySum()

// or

let items = dynamic({"days":[43, 21, 65]});
print items
| project sum = series_stats_dynamic(items.days)["avg"] * array_length(items.days)

根据稍后提供的评论更新示例：

datatable (Operation_id:string, customDimensions:dynamic) 
[ 
    "MTFfq", dynamic({"siteId": "1", "fileCount": "3", "pendingDays":[15,10,11]}), 
    "LXVjk", dynamic({"siteId": "2", "fileCount": "1", "pendingDays":[3]}),
    "jnySt", dynamic({"siteId": "3", "fileCount": "2", "pendingDays":[7,11]}), 
    "NoxoX", dynamic({"siteId": "4", "fileCount": "4", "pendingDays":[1,4,3,11]})
]
| mvexpand days = customDimensions.pendingDays to typeof(int)
| summarize avg(days) by Operation_id

// or

datatable (Operation_id:string, customDimensions:dynamic) 
[ 
    "MTFfq", dynamic({"siteId": "1", "fileCount": "3", "pendingDays":[15,10,11]}), 
    "LXVjk", dynamic({"siteId": "2", "fileCount": "1", "pendingDays":[3]}),
    "jnySt", dynamic({"siteId": "3", "fileCount": "2", "pendingDays":[7,11]}), 
    "NoxoX", dynamic({"siteId": "4", "fileCount": "4", "pendingDays":[1,4,3,11]})
]
| project Operation_id, series_stats_dynamic(customDimensions.pendingDays)['avg']

和：

let arraySum = (T:(x: long))
{
   T 
   | summarize sum(x) 
};
datatable (Operation_id:string, customDimensions:dynamic) 
[ 
    "MTFfq", dynamic({"siteId": "1", "fileCount": "3", "pendingDays":[15,10,11]}), 
    "LXVjk", dynamic({"siteId": "2", "fileCount": "1", "pendingDays":[3]}),
    "jnySt", dynamic({"siteId": "3", "fileCount": "2", "pendingDays":[7,11]}), 
    "NoxoX", dynamic({"siteId": "4", "fileCount": "4", "pendingDays":[1,4,3,11]})
]
| mvexpand x = customDimensions.pendingDays to typeof(long)
| invoke arraySum()

// or

datatable (Operation_id:string, customDimensions:dynamic) 
[ 
    "MTFfq", dynamic({"siteId": "1", "fileCount": "3", "pendingDays":[15,10,11]}), 
    "LXVjk", dynamic({"siteId": "2", "fileCount": "1", "pendingDays":[3]}),
    "jnySt", dynamic({"siteId": "3", "fileCount": "2", "pendingDays":[7,11]}), 
    "NoxoX", dynamic({"siteId": "4", "fileCount": "4", "pendingDays":[1,4,3,11]})
]
| project Operation_id, sum = series_stats_dynamic(customDimensions.pendingDays)["avg"] * array_length(customDimensions.pendingDays)

上面使用的 operators/functions 的一些参考资料：

在 Azure 数据资源管理器中聚合数组列的内容

Aggregate contents of array column in Azure Data Explorer

azure-application-insights

azure-data-explorer