来自 Azure 事件中心的日志数据被提取到 ADX table ，没有显示任何记录，但记录计数即将到来

Question

[

我正在从事件中心提取日志数据到 ADX table，没有提取错误，但记录没有显示在 ADX Table 中。我检查了 ADX 和 Event Hub 的指标，那里看起来都不错。我怀疑我在 ADX 的 Json 映射中犯了一些错误，请帮助！。 JSON 输入日志-
{"Result":{"AppId":"VC4RAKOlhdK8sPuK","Id":null,"UserId":"7f471608-a395-46ce-9d57-8503075ce948","Email":"dspadmin@innovationshowcase.onmicrosoft.com","RoleName":"User","Operation":"Login","Params":null},"Id":5,"Exception":null,"Status":5,"IsCanceled":0,"IsCompleted":1,"IsCompletedSuccessfully":1,"CreationOptions":0,"AsyncState":null,"IsFaulted":0,"EventProcessedUtcTime":"2020-04-09T10:39:19.8965009Z","PartitionId":0,"EventEnqueuedUtcTime":"2020-04-09T09:04:30.8100000Z"}

Table 已创建 -

.create table EventRaw (AppId:string,Id:string,UserId:string,Email:string,RoleName:string,Operation:string,Params:string,EventProcessedUtcTime:datetime,PartitionId:string,EventEnqueuedUtcTime:datetime)

映射应用在 ADX Table

  .create table EventRaw ingestion json mapping 'Mapping' '[{"column":"AppId", "Properties": {"Path": "$.appid"}},{"column":"Id", "Properties": {"Path": "$.id"}},{"column":"UserId", "Properties": {"Path":"$.userid"}} ,{"column":"Email", "Properties": {"Path":"$.email"}}, {"column":"RoleName", "Properties": {"Path":"$.rolename"}},{"column":"Operation", "Properties": {"Path":"$.operation"}},{"column":"Params", "Properties": {"Path":"$.params"}},{"column":"EventProcessedUtcTime", "Properties": {"Path":"$.eventprocessedutctime"}},{"column":"PartitionId", "Properties": {"Path":"$.partitionid"}},{"column":"EventEnqueuedUtcTime", "Properties": {"Path":"$.eventenqueuedUtctime"}}]'

非常感谢您的帮助！

Answer 1

json 映射中的 'Path' 区分大小写，我看到您的映射使用了不同的大小写，例如 json 属性 Email 映射为 "Path":"$.email" 它应该是 "Path":"$.Email"

来自 Azure 事件中心的日志数据被提取到 ADX table ，没有显示任何记录，但记录计数即将到来

Log data from Azure Event Hub is ingested to ADX table , no records being displayed but record counts are coming

azure-eventhub

kql

azure-data-explorer