在 Kusto 中匹配词后提取以下词

Question

Kusto 使用 re2 库：https://github.com/google/re2/wiki/Syntax, as mentioned here: https://docs.microsoft.com/en-us/azure/kusto/query/re2 所以显然不支持 lookarounds。

示例 String:Some 句子。一些词一些词 ServiceInstanceId:78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234 未找到。 , ErrorCode:2 一些句子。一些 sentences.Some 句子。

是否可以从 Kusto 中的上述字符串中提取 78d61d2f-6df9-4ba4-a192-0713d3cd8a82。需要“ServiceInstanceId:”之后的所有字符，直到下一个 space.

Answer 1

您可以使用 parse:

let MyTable = datatable(s:string) [
    "Sample String:Some sentence. Some word Some word ServiceInstanceId:78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234 not found. , ErrorCode:2 Some sentences. Some sentences.Some sentences."
];
MyTable
| parse s with * "ServiceInstanceId:" ServiceInstanceId " " *

结果：

s	ServiceInstanceId
Sample String:Some sentence. Some word Some word ServiceInstanceId:78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234 not found. , ErrorCode:2 Some sentences. Some sentences.Some sentences.	78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234

注意：您要求提取到下一个 space，所以答案应该是“78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234”，而不仅仅是“78d61d2f-6df9-4ba4” -a192-0713d3cd8a82".

在 Kusto 中匹配词后提取以下词

Extract following word after match word in Kusto

parsing

text

kql

kusto-explorer