如何扩展在 Kusto 中存储为属性的数组值

Question

我有一个属性包（json 对象），不幸的是它有一个通过动态命名属性的对象数组，而不是一个实际的数组。包中还有其他属性。例如：

{
  "something": "whatever",
  "another": "doesn't matter",
  "thing1": "value1",
  "thing2": "value2",
  "thing3": "value3"
}

最终我希望每个 thing 有一行：

value1
value2
value3

我知道我可以使用 mv-expand 将数组或属性包转换成多行，但我不确定如何

仅保留键以 "thing"
丢弃密钥，只保留值

以防万一，每个属性包的物品数量差异很大。通常只有一个，但有时是 10-20 个，很少有 100 个或更多。

Answer 1

你可以尝试使用 mv-apply:

datatable(d:dynamic)
[
    dynamic({"something":"whatever","another":"doesn'tmatter","thing1":"value1","thing2":"value2","thing3":"value3"}),
    dynamic({"somethingelse":"whatever2","another":"doesn'tmatter2","thing1":"value12","thing2":"value22","thing3":"value32"}),
]
| mv-apply d on (
    extend key = tostring(bag_keys(d)[0])
    | where key startswith "thing"
    | project value = d[key]
)

哪个returns:

| value   |
|---------|
| value1  |
| value2  |
| value3  |
| value12 |
| value22 |
| value32 |

如何扩展在 Kusto 中存储为属性的数组值

How to expand array values stored as properties in Kusto

kql

azure-data-explorer