如何在 Azure 数据资源管理器中解析复杂的 json 对象
How do I parse complex json object in Azure Data Explorer
我有以下 属性，我需要将其解析为 JSON。我尝试使用 parse_json() 但它不起作用
查询
AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatus == "Started"
| where (Properties contains "8e3af657-a8ff-443c-a75c-2fe8c4bcb635") or (Properties contains "b24988ac-6180-42a0-ab88-20f7382dd24c")
| extend request = parse_json(Properties)
| where request.requestbody.Properties.Scope == "/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171"
需要解析的原始数据
{ "requestbody":
"{\"Id\":\"992a2739-9bd2-4d04-bc5f-5ed1142b9861\",\"Properties\":{\"PrincipalId\":\"5ac319a4-740b-4f09-9fd3-fce3ce91fedf\",\"RoleDefinitionId\":\"/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635\",\"Scope\":\"/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171\"}}"
}
看看 this page (also quoted below), which explains why the following works (BTW, note that I've replaced contains 的底部，从效率的角度来看 has：
AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatus == "Started"
| where (Properties has "8e3af657-a8ff-443c-a75c-2fe8c4bcb635") or (Properties has "b24988ac-6180-42a0-ab88-20f7382dd24c")
| extend request = parse_json(tostring(parse_json(Properties).requestbody))
| project request.Properties.Scope
It is somewhat common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.
For example:
let d='{"a":123, "b":"{\"c\":456}"}'; print d
In such cases, it is not only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring will be used. Otherwise, the second call to parse_json will simply pass-on the input to the output as-is, because its declared type is dynamic:
let d='{"a":123, "b":"{\"c\":456}"}'; print d_b_c=parse_json(tostring(parse_json(d).b)).c
我有以下 属性，我需要将其解析为 JSON。我尝试使用 parse_json() 但它不起作用
查询
AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatus == "Started"
| where (Properties contains "8e3af657-a8ff-443c-a75c-2fe8c4bcb635") or (Properties contains "b24988ac-6180-42a0-ab88-20f7382dd24c")
| extend request = parse_json(Properties)
| where request.requestbody.Properties.Scope == "/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171"
需要解析的原始数据
{ "requestbody": "{\"Id\":\"992a2739-9bd2-4d04-bc5f-5ed1142b9861\",\"Properties\":{\"PrincipalId\":\"5ac319a4-740b-4f09-9fd3-fce3ce91fedf\",\"RoleDefinitionId\":\"/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635\",\"Scope\":\"/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171\"}}" }
看看 this page (also quoted below), which explains why the following works (BTW, note that I've replaced contains 的底部，从效率的角度来看 has：
AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatus == "Started"
| where (Properties has "8e3af657-a8ff-443c-a75c-2fe8c4bcb635") or (Properties has "b24988ac-6180-42a0-ab88-20f7382dd24c")
| extend request = parse_json(tostring(parse_json(Properties).requestbody))
| project request.Properties.Scope
It is somewhat common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.
For example:
let d='{"a":123, "b":"{\"c\":456}"}'; print dIn such cases, it is not only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring will be used. Otherwise, the second call to parse_json will simply pass-on the input to the output as-is, because its declared type is dynamic:
let d='{"a":123, "b":"{\"c\":456}"}'; print d_b_c=parse_json(tostring(parse_json(d).b)).c