使用流分析作业查询从 EventHub 过滤 azure 事件

Question

因此，我想使用流分析作业捕获 Azure 发送到 EventHub 的管理事件，并仅将符合特定条件的事件转发到 Azure 函数。事件出现在这样的对象中（经过大量修剪以简化）：

{
  "records": [
    {
      "resourceId": "<resource_path>",
      "operationName": "MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE",
    },
    {
      "time": "2021-03-19T19:19:56.0639872Z",
      "operationName": "MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE",
      "category": "Administrative",
      "resultType": "Accept",
      "resultSignature": "Accepted.Created",
      "properties": {
        "statusCode": "Created",
        "serviceRequestId": "<trimmed>",
        "eventCategory": "Administrative",
        "message": "Microsoft.Compute/virtualMachines/write",
        "hierarchy": "<trimmed>"
      },
      "tenantId": "<trimmed>"
    }
  ],
  "EventProcessedUtcTime": "2021-03-19T19:25:21.1471185Z",
  "PartitionId": 1,
  "EventEnqueuedUtcTime": "2021-03-19T19:20:43.9080000Z"
}

我想根据这些条件过滤查询：records[0].operationName = 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE' AND records[1].properties.statusCode = 'Created'。为实现这一目标，我从 returns 这条记录的以下查询开始，但它缺少我需要匹配的条件之一 (statusCode)

SELECT
    records
INTO
    [output]
FROM
    [input]
WHERE
    GetArrayElement(records, 0).operationName = 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE'

尝试以下查询无效（returns 0 个匹配）：

SELECT
    records
INTO
    [output]
FROM
    [input]
WHERE
    GetArrayElement(records, 0).operationName = 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE'
    AND GetArrayElement(records, 1).properties.statusCode = 'OK'

有人对此有线索吗？

Answer 1

找到解决办法了！我需要使用 GetRecordPropertyValue，像这样：

SELECT
    records
INTO
    [output]
FROM
    [input]
WHERE
    GetArrayElement(records, 0).operationName = 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE'
    AND GetRecordPropertyValue(GetArrayElement(records, 1).properties, 'statusCode') = 'Created'

对我来说看起来有点笨拙，但它奏效了！

使用流分析作业查询从 EventHub 过滤 azure 事件

Filtering azure events from EventHub with Stream Analytics job query

azure

azure-stream-analytics