使用用户定义的函数进行参数化，KQL

Question

我想在 KQL 中的函数中添加一个变量，如下所示。知道怎么做吗？我尝试了 str_concat() 但抛出了一条错误消息。其他一些想法？此函数应该 return 函数内的正则表达式模式，在本例中就是 X 中指定的单词之后的单词。

let MyFunction = (X: string, arg1: string){extract("{X}\s([^\s]+", 1, Y)};
datatable(Num:int, Message: string)[
1, "Ye who in rhymes dispersed the echoes hear",
2, "Of those sad sighs with which my heart I fed",
3, "When early youth my mazy wanderings led",
4, "Fondly different from what I now appear"]
extend 
My = MyFunction("my", Message),
Preposition = MyFunction("[Of|in|from]", Message)

Answer 1

您可以使用逐字字符串 (@"...")，因此不需要双重转义 (\)
捕获组（要提取的部分）由括号定义((...))
正则表达式 OR 运算符 | 应像 X|Y|Z 一样使用，[] 用于定义字符集。
通过使用 [Of|in|from]，您基本上定义了一组字符，其中包括字符 O、f、|、i、n、r、o & m
(?:...) 将参数与文本正确分开，但避免将其视为捕获组

let MyFunction = (X: string, Y: string){extract(strcat("(?i:",X, @")\s+(\S+)"), 1, Y)};
datatable(Num:int, Message: string)[
1, "Ye who in rhymes dispersed the echoes hear",
2, "Of those sad sighs with which my heart I fed",
3, "When early youth my mazy wanderings led",
4, "Fondly different from what I now appear"]
| extend My = MyFunction("my", Message), Preposition = MyFunction("of|in|from", Message)

Num	Message	My	Preposition
1	Ye who in rhymes dispersed the echoes hear		rhymes
2	Of those sad sighs with which my heart I fed	heart	those
3	When early youth my mazy wanderings led	mazy
4	Fondly different from what I now appear		what

Fiddle

使用用户定义的函数进行参数化，KQL

Paramaterization with user defined functions, KQL

azure-data-explorer

kql