KQL

Question

我有一个 table 列的动态单元格。这是作为字典从 .Net 中提取的，但在 Kusto 中它看起来像一个对象数组，具有属性键和值：

[
    {"key":"ProjectId","value":"1234"},
    {"key":"ProjectName","value":"Albatros"},
    {"key":"User","value":"Bond"}
]

我想将我的 Kusto 查询中的单元格内容转换为以下动态：

{
  "ProjectId": "1234",
  "ProjectName": "Albatros",
  "User": "Bond"
}

我不知道如何编写表达式，将其从数组转换为新的动态格式。

谁能指出我正确的方向？

Answer 1

您可以使用 mv-apply and make_bag():

的组合

print d = dynamic([
  {"key": "value"},
  {"ProjectId": "1234"},
  {"ProjectName": "Albatros"},
  {"User": "Bond"}
])
| mv-apply d on (
    summarize result = make_bag(d)
)

result
{ "key": "value", "ProjectId": "1234", "ProjectName": "Albatros", "User": "Bond" }

UPDATE 根据你对原问题的修改：

print d = dynamic([
    {"key":"ProjectId","value":"1234"},
    {"key":"ProjectName","value":"Albatros"},
    {"key":"User","value":"Bond"}
])
| mv-apply d on (
    summarize result = make_bag(pack(tostring(d.key), d.value))
)

result
{ "ProjectId": "1234", "ProjectName": "Albatros", "User": "Bond" }

KQL - 将键值动态数组转换为键值字典

KQL - Convert Dynamic Array of Key Value to Key Value dictionary

azure-data-explorer